M365 spo app add 403 Forbidden error

[tabit01]

Trying to upload a Sharepoint solution to our app registration/tenant via Azure DevOps pipeline. We get a 403 Forbidden error, which we are debugging.

Sorry for asking this, I know this forum is not an Azure support provider: does anyone here have experience from similar permission issues?

Dump from pipeline run (sorry for missing indentation):

Generating script. 
Script contents: 
m365 spo app add --filePath "/home/vsts/work/1/drop/sharepoint/solution/XXX.sppkg" --overwrite --debug --verbose 
========================== Starting Command Output =========================== 
/usr/bin/bash --noprofile --norc /home/vsts/work/_temp/7198ef81-19cf-4488-83e3-4a2460b8ae43.sh 
Executing command spo app add with options {"options":{"filePath":"/home/vsts/work/1/drop/sharepoint/solution/XXXXX.sppkg","overwrite":true,"debug":true,"verbose":true}} 
No SPO URL available. Retrieving from MS Graph... 
Existing token <ACCESS TOKEN>
Request: 
{ 
"url": "[https://graph.microsoft.com/v1.0/sites/root?$select=webUrl",](https://graph.microsoft.com/v1.0/sites/root?$select=webUrl%22,) 
"method": "get", 
"headers": { 
"common": { 
 "Accept": "application/json, text/plain, */*" 
}, 
"delete": {}, 
"get": {}, 
"head": {}, 
"post": { 
"Content-Type": "application/x-www-form-urlencoded" 
}, 
  "put": { 
  "Content-Type": "application/x-www-form-urlencoded" 
}, 
"patch": { 
"Content-Type": "application/x-www-form-urlencoded" 
}, 
  "user-agent": "NONISV|SharePointPnP|CLIMicrosoft365/5.4.0", 
  "accept-encoding": "gzip, deflate", 
  "accept": "application/json;odata.metadata=none", 
  "authorization": "Bearer 
	  TOKEN" 
}, 
"responseType": "json", 
"decompress": true 
} 
Request error: 
{ 
  "url": "[https://graph.microsoft.com/v1.0/sites/root?$select=webUrl",](https://graph.microsoft.com/v1.0/sites/root?$select=webUrl%22,) 
  "status": 403, 
  "statusText": "Forbidden", 
  "headers": { 
  "cache-control": "no-store, no-cache", 
  "transfer-encoding": "chunked", 
  "content-type": "application/json", 
  "vary": "Accept-Encoding", 
  "strict-transport-security": "max-age=31536000", 
  "request-id": "2390379e-4a97-4d25-a0f6-221f772b3bf3", 
  "client-request-id": "2390379e-4a97-4d25-a0f6-221f772b3bf3", 
  "x-ms-ags-diagnostic": "{\"ServerInfo\":{\"DataCenter\":\:XXXXXXXX\",\"Slice\":\"E\",\"Ring\":\"5\",\"ScaleUnit\":\"005\",\"RoleInstance\":\"AM4PEPF00018A67\"}}", 
"date": "Tue, 12 Jul 2022 08:48:23 GMT", 
"connection": "close" 
}, 
"error": { 
"error": { 
    "code": "accessDenied", 
    "message": "Access denied", 
    "innerError": { 
    "date": "2022-07-12T08:48:23", 
    "request-id": "2390379e-4a97-4d25-a0f6-221f772b3bf3", 
    "client-request-id": "2390379e-4a97-4d25-a0f6-221f772b3bf3" 
  } 
} 
} 
} 
Error: Request failed with status code 403 
##[error]Bash exited with code '1'.

Here is the permissions set for this AppRegistration (to which the Client ID belong):

AppCatalog.ReadWrite.All 
Sites.ReadWrite.All

UPDATE

• The "url": "https://graph.microsoft.com/v1.0/sites/root?$select=webUrl", checks out
• The error is the same with scope tenant or sitecollection
• The error is the same in my personal dev tenant, when replicating the pipeline

[martinlingstuyl]

Hi @tor-axbit,
If you decode the token that's used to call the endpoint, does it actually contain the scopes the endpoint needs?

The CLI is trying to discover your SharePoint online root URL, using the Graph.
You could try working around this by first setting the root url using the m365 spo set command. This is better anyway, you'll need less permissions.

[tabit01]

The pipeline deployment is working on my dev tenant, using Sites.Selected permission in my AppRegistration, and

Grant-PnPAzureADAppSitePermission -AppId "<Client ID>" -DisplayName "TestApp" -Permissions Write -Site https://<tenant>.sharepoint.com/sites/<site with app catalog>

in PnP PowerShell. Thanks for helping out!

[martinlingstuyl]

That's awesome. And I assume by /MyTestsite you mean the appcatalog?

[tabit01]

yes, sorry for ambiguity. I created a separate app catalog for the site (collection) MyTestSite. I edited the script in my comment.

[martinlingstuyl]

By the way, you can also give permissions to a site using the cli:

m365 spo site apppermission add --siteUrl "https://<tenant>.sharepoint.com/sites/<site with app catalog>" --permission write --appId "<Client ID>" --appDisplayName "TestApp"

[tabit01]

nice, thanks!