I'm in the process of deploying a Provider Hosted App in SharePoint online, the app is hosted in my Azure website, and added to my app catalog, I have made sure to sync the ClientID and ClientSecret so that they are the same values as I got them when I registered the app in my site collection. Until this point everything is great, the app gets deployed and I can consume its services, but when I try to do the same steps on another tenant I get the message below:

Access denied. You do not have permission to perform this action or access this resource.

In the other tenant I get no problems with:

  • Publishing the app to my azure website
  • Adding the .app file to the tenant's app catalog.
  • Adding the app to the tenant's site collection.

I get the above message when I click on the app!

I have site collection administrator permissions in the other tenant's site collection and app catalog. The app permissions are set to Full Control in the Site Collection Do I need to be tenant admin in order to consume the app? I know it sounds wierd as the app gets deployed with no issues, any ideas?

Thanks in advance!

  • Make sure you use the same ClientID and client secret , when you register the App in the 2nd tenant.
    – Unnie
    Jun 11, 2015 at 9:57
  • I just registered the App in the 2nd tenant using ClientID and ClientSecret that I got from the registration in the 1st tenant where it worked, still get the same issue. Jun 11, 2015 at 11:10
  • Did you do a tenant scope deployment or site/web scope? Try doing a tenant scope deployment to troubleshoot
    – Unnie
    Jun 11, 2015 at 11:14
  • Thanks for bearing with me! :-) I'm not the admin of the 2nd tenant, I just noticed something more weird, despite the fact of me being a Site Collection Administrator, I can't for example delete a folder that I or the App created, so that's not strange that the App doesn't get access to the site collection, what the App really does is that it creates a folder in Style Library and Master Page Library, and then uploads some files into those folders, some how the App doesn't get authenticated into those two folders, not even as I said when I try to do it manually... Jun 11, 2015 at 11:40

1 Answer 1


You can't use ClientID and ClientSecret from Tenant A and use it across tenant B. The scope of ClientID and ClientSecret has to be within same tenant irrespective of site collection (boundaries) which it is generated from.

So you generate ClientID and ClientSecret from some site collection in tenant B (where apparently your App doesn't suppose to work)?

And same clientID and ClientSecret is being used by web app in Azure? Remember you can publish web app to any Azure tenant you want.

Have you enabled https for Azure web app while publishing app?

  • Thanks for your attention Falak, I ended up realizing that the whole problem had to do with a strange behavior in that specific tenant, the second tenant where I tried to deploy the app, the strange thing there was that I happened to lack permissions despite being a Site Collection Administrator, I tested for example creating a folder and was never able to delete it due to missing permission. However, the workaround we took was deploying to a site collection which does not lie at the root level. Jun 24, 2015 at 9:30
  • Regarding ClientID & ClientSecret, I experienced that they could be the same across two different tenants as it works for me right now. And yes, those two values are the same in the Azure tenant, even https for Azure web app is enabled. Jun 24, 2015 at 9:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.