Approving SharePoint API access permissions in admin center

[AlexFilipovici]

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

💥 SharePoint Framework

Developer environment

None

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

No response

Describe the bug / error

When we try to approve a SharePoint API permission in the SharePoint admin center under "Pending requests" it seems that our request has been fulfilled. At first glance the approved permission moves to the"Approved requests" group in the UI. After refreshing the page we see that the requests are not visible anymore in the "Approved requests" group.

When we inspect the network traffic, while approving, we see that the Deny endpoint is called when approving: https://tenant-admin.sharepoint.com/_api/SPOInternalUseOnly.SPOWebAppServicePrincipal/PermissionRequests('GUID')/Deny

The SPFX functionality breaks as depicted below:

Steps to reproduce

1. Go to https://tenant-admin.sharepoint.com/_layouts/15/online/AdminHome.aspx#/webApiPermissionManagement
2. Click on a pending request and approve it
3. Notice that the request has been visually approved and moved to the "Approved requests" group
4. Refresh the page and notice that the approved request is not visible anymore

Expected behavior

Request should be approved instead of denied when approving it.

[joelfmrodrigues]

I am experiencing the same

[joelfmrodrigues]

For anyone desperate for a workaround, permissions can be added directly to the Entra ID app registration that is used by SPFx. Here is a blog post covering this: https://michaelmaillot.github.io/tips/20210302-spfx-api-permissions/

[GrahamMcMynn]

Thank you for notifying us of this issue. A fix is rolling out and should reach 100% of prod on Monday December 16th. The deny is actually expected and will continue to happen. After we approve the permission (which we weren't doing and is the cause of the bug), we call the deny endpoint to remove the request from the queue.

[VesaJuvonen]

@AlexFilipovici and @joelfmrodrigues - can you confirm that the fix is now out and things are working, like @GrahamMcMynn was sharing? - Just that we get this and #10041 closed as fix. Thx for confirming.

[joelfmrodrigues]

@VesaJuvonen is not working for me yet

[joelfmrodrigues]

@GrahamMcMynn sorry to tag you here but just checking if you are also aware of a parallel discussion on this issue: #10041

Issue seems to not be resolved yet 😟

[joelfmrodrigues]

@AlexFilipovici it just started working for me