I want to call Dynamics CRM API from SPFx. What I've tried so far.


 .then((client: AadHttpClient): void => {
     .get('<Organization URL>/api/data/v9.0/accounts?$select=name,address1_city&$top=10', AadHttpClient.configurations.v1)
     .then((response: HttpClientResponse): any => {
       return response.json();

After that, an alert appears which shows the message:

Additional credentials are required to show this page correctly.

If I click Ok then it will redirect to SharePoint home page. Else if I click Cancel then it will show me the error:

Error: AADSTS65001: The user or administrator has not consented to use the application with ID '' named 'SharePoint Online Client Extensibility Web Application Principal'. Send an interactive authorization request for this user and resource.

Tried Solution:

Already Grant Permission in Azure AD app. Permission is set for Dynamics CRM online.

Image Description:

enter image description here


Sometimes it shows the error mentioned in the image.

Image Description:

enter image description here

3 Answers 3


It seems you have an issue similar to this one: https://github.com/SharePoint/sp-dev-docs/issues/2473#issuecomment-419267563

The workaround for now is to add the User.Read scope for AAD in the package-solution.json

"webApiPermissionRequests": [
        "resource": "Windows Azure Active Directory",
        "scope": "User.Read"

And then re-upload your solution and re-approve the permissions in the SPO Tenant Admin API management page.

But as I understand, a fix is being rolled out to all Azure AD tenants which would mean we no longer have to do the workaround.

  • I did but no success, Strange but sometimes it shows: Token renewal operation failed due to timeout Sep 17, 2018 at 4:56

Go to the Azure AD and grant CRM Dynamics permissions to the "SharePoint Online Client Extensibility Web Application Principal". Find this under App Registrations in your Azure AD.


Permissions in Azure

Then get the client by:

    .then((client: AadHttpClient): void => {

Try this:

1.) Go to Azure App Registration, Open your registration manifest, and change this line from false, to true: "oauth2AllowImplicitFlow": false

2.) Then go to the registration settings, and in the Required permissions click the 'Grant permission' button, then yes. This will overrule the consent(or its absence) of all users in the directory. This way users do not need to consent one-by-one phisically clicking a button to log in with their account trough oauth.

You can check these granted permission in the app's page in the permissions section.

  • Just to be clear, when i say 'Grant permission' i dont mean selecting the D365 permission in the app reg. i mean this button Oct 11, 2018 at 18:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.