Error while login in since yesterday evening

[apc005]

Hi everybody

Since yesterday evening (UTC+2) I get an error when tryning to login :

Error: unauthorized_client: 700016 - [2024-09-10 07:08:56Z]: AADSTS700016: Application with identifier 'xxxxxx' was not found in the directory 'xxxx'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant. Trace ID: xxxx Correlation ID: xxxxTimestamp: 2024-09-10 07:08:56Z - Correlation ID: xxxx - Trace ID: xxxx

Was working perfectly since monthes before.

Any hint would be greatly appreciated !

Regards

[milanholemans]

Hi @apc005 which version of CLI are you using? Because of some breaking changes regarding the PnP app registration, we had to release v9. If you were using m365 login without specifying --appId, you'll have to upgrade to the latest version of CLI and register your own app registration.
Here is some info about this change: https://pnp.github.io/blog/post/changes-pnp-management-shell-registration
About the new CLI version: https://pnp.github.io/blog/cli-for-microsoft-365/cli-for-microsoft-365-v9-0

[Jwaegebaert]

Hey @apc005, just a heads up, yesterday, the PnP Management Shell app registration was updated. Could it be that you're using this registration? You can check out more details about the changes here: https://pnp.github.io/blog/post/changes-pnp-management-shell-registration/.

To work around these changes, the team has developed an alternative experience. The best approach is to create a new app registration with only the permission scopes your script needs. If you prefer a similar setup to the old registration, you can still create that too. You can use the m365 setup command (https://pnp.github.io/cli-microsoft365/cmd/setup) to guide you through creating a new app registration with the same scope list as before.

[Adam-it]

yes. Since yesterday the PnP Management Shell was removed from all tenants. This was the default app that was used by CLI for M365 to perform login. You may read more about this announcement and reasoning behind it in this release blog post
https://pnp.github.io/blog/post/changes-pnp-management-shell-registration/

It was a very short notice also for us. It is still possible to use CLI but now you need to define the your own app registration and when performing login you need to pass the appId and tenant options either when running the command or as configs or as env variables. So it is still possible to use any CLI version
m365 login --appId 31359c7f-bd7e-475c-86db-fdb8c937548c --tenant 31359c7f-bd7e-475c-86db-fdb8c937548a

Also one week ago we release a new major release v9 https://pnp.github.io/blog/cli-for-microsoft-365/cli-for-microsoft-365-v9-0
the biggest changes made are those that address this new login behavior.
Now m365 setup command that will allow you to create such an app in a matter of seconds. Please check the latest updates described in detail in this chapter https://pnp.github.io/blog/cli-for-microsoft-365/cli-for-microsoft-365-v9-0/#the-new-major-version-of-cli-for-microsoft-365--v9

[milanholemans]

Thank you so much for the quick response! I created a new app registration and chose all permissions. Are there some commands I could run to check and/or add the needed permissions? Thank you!

Can you check the following?

1. Go to Azure
2. Search for Application registrations
3. Click All applications and search for CLI for Microsoft 365
4. Click API permissions
5. Check if all permissions are granted
   

Additionally you could run m365 doctor to check your current scopes.

[dshirk-uci]

Many thanks for the quick replies! Unfortunately our administrator has evidently disabled the app registration experience in the azure portal (attaching screenshot). I'm attempting to get in touch with them to get this turned on ASAP. Also, I tried running "m365 doctor" but I'm getting a usage message "Command 'doctor' was not found. Below you can find the commands and command groups you can use.". I did successfully upgrade to v9 and the "m365 version" command returns "v9.0.0".

I'm wondering if maybe I need to try the "m365 setup" again... maybe there was some problem with adding the necesary permissions.

[dshirk-uci]

Could you open up a separate bug/issue for your case so we may track it separately 🙏

OK thanks I just opened a new issue 6333. The instructions for opening the ticket gave the syntax for the "doctor" command so I ran it and here is the output (appId redacted):

$ m365 cli doctor
{
"os": {
"platform": "linux",
"version": "#1 SMP Mon Nov 8 13:30:15 EST 2021",
"release": "4.18.0-553.16.1.el8_10.x86_64"
},
"cliVersion": "9.0.0",
"nodeVersion": "v18.12.0",
"cliAadAppId": "xxxxxxxx-yyyyy-zzzzz-bbee-xxxxxxxxxxx",
"cliAadAppTenant": "common",
"authMode": "deviceCode",
"cliEnvironment": "",
"cliConfig": {},
"roles": [],
"scopes": {
"https://graph.microsoft.com": [
"AuditLog.Read.All",
"Directory.AccessAsUser.All",
"email",
"Group.ReadWrite.All",
"openid",
"profile",
"User.ReadWrite.All"
],
"https://ucirvine.sharepoint.com": [
"user_impersonation"
]
}
}

I'm wondering if maybe this problem is happening because our admin has disable the app registration experience in the azure portal (see screenshot in previous comment).

[dshirk-uci]

For future reference I'm posting in here that our issues were resolved by manually adding the application registration permissions following the instructions here:

https://pnp.github.io/cli-microsoft365/user-guide/using-own-identity/

After that was done, the m365 login was successful with app ID and tenant ID.

Thanks to everybody who develops, documents and supports this extremely useful tool. I know it is a lot of effort and I am grateful.

[Adam-it]

thank you for the kind words. Keeps our team motivated 🙏