2

I am trying to allow an app to get a user's manager. According to the documentation I need User.Read.All permission:

enter image description here

So in my SPFx, I added the request:

"webApiPermissionRequests": [
  {
    "resource": "Microsoft Graph",
    "scope": "User.Read.All"
  }
]

I deployed the app to the tenant Apps Catalog, add it to a site, add it to a page and run it. I get this error:

enter image description here

I then ask our Admin team to go to the SharePoint API Management to approve the new permission, but it doesn't show up in their list. All they see is a User.ReadBasic.All that they approved awhile ago.

What could I be doing wrong?

EDIT:

I tried removing the app from the App Catalog and added it again, I get this dialog box:

enter image description here

So the catalog see's the API requests.

  • I don't see anything incorrect in the steps you have mentioned. Can you try re-uploading the solution in the tenant app catalog and checking if the permissions appear in the API management page? – Vardhaman Deshpande Feb 14 at 16:29
  • @VardhamanDeshpande I have deployed the app a couple of dozen times trying different things. I just removed it from the app cat and re-added it. I posted the deploy msg saying it will have pending permissions. – Holden1515 Feb 14 at 16:46
1

Your dialog doesn't say that the app needs User.Read.All permission. Have you configured the permission correctly? Here is how the config/package-solution.json should look:

{
  "$schema": "https://developer.microsoft.com/json-schemas/spfx-build/package-solution.schema.json",
  "solution": {
    "name": "sp-fx-teams-220-client-side-solution",
    "id": "62ab7ec3-76ba-4df3-86a5-46908ed4837e",
    "version": "1.0.0.0",
    "includeClientSideAssets": true,
    "skipFeatureDeployment": true,
    "webApiPermissionRequests": [
      {
        "resource": "Microsoft Graph",
        "scope": "User.Read.All"
      }
    ]
  },
  "paths": {
    "zippedPackage": "solution/sp-fx-teams-220.sppkg"
  }
}
  • Yes, sorry, I changed ti from User.Read.All to User.Read after reading more into the permissions. I only ever need the signed in user to get the manager and the All lets you get anybody's manager if the signed in user's permissions allows it (aka site collection admin). – Holden1515 Feb 14 at 17:15
  • You need the User.Read.All permission to call the /me/manager endpoint. This is because you are reading the profile of another user (your manager). – Vardhaman Deshpande Feb 14 at 21:24
  • Still won't explain why it doesn't show up in the API Management permissions list. – Holden1515 Feb 14 at 23:06
  • And you have updated it to be User.Read.All in the package-solution.json? – Vardhaman Deshpande Feb 15 at 9:51
  • I had tried a couple dozen times before posting here, yes. I apologize for the confusion. – Holden1515 Feb 15 at 19:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.