0
votes

I´ve built an SPFx Webpart, which requests a SharePoint list via the Microsoft Graph. It works fine in both SharePoint and as a Microsoft Teams Tab. However, when I try to run it in Teams as a personal App, I always get an error 403 forbidden.

As a debug measure, I followed a Microsoft tutorial on making a simple graph call https://docs.microsoft.com/de-de/sharepoint/dev/spfx/use-msgraph. After trying the webpart in both SharePoint and Teams again, I ran into the same issue. It works both in SharePoint and as a Teams tab, but not as a Teams personal app.

public render(): void {
this.context.msGraphClientFactory
  .getClient()
  .then((client: MSGraphClient): void => {
    // use MSGraphClient here
    // get information about the current user from the Microsoft Graph
    client
      .api('/me')
      .get((error, user: MicrosoftGraph.User, rawResponse?: any) => {
        console.log(user);

        this.domElement.innerHTML = `
          <div class=${styles.container}>
            <h2>${user.displayName}</h2>
          </div>
        `;

        if(error) {
          console.log("Error: ");
          console.log(error);
        }

    });
  });
}

As the last test, I downloaded an already made and functioning project which requests data via the Microsoft Graph https://github.com/pnp/sp-dev-fx-webparts/tree/master/samples/react-teams-personal-app-settings, and it returned the same error.

Additionally, the global admins in our tenant have no issue using these apps as a Microsoft Teams personal App. The problem only occurs for standard users.

Does anyone know why this web part won't work as a personal app but anywhere else, and also how to fix this issue?

18.11.2020: Quick update about the problem: After an admin granted all the permissions again, all the apps now works in the teams web client as a personal app, but still not in the desktop app as a personal app.

Another update about the problem: I tried installing Teams in Linux as a test, and as it turned out, all the apps work as Teams personal apps there.

1
Do you grant delegation permission for the app and grant admin consent for that permission? - Carl Zhao
Yes, the global admins in our tenant granted them for every user. But the app still returns the same error when used as a Teams personal app. - JBLConsult
@JBLConsult Are you still facing the issue? If so please share the requestid and timestamp for the failed request and the whole error response. - Shiva Keshav Varma
@Shiva-MSFTIdentity, yes, I'm still facing the issue. The response I'm getting from the server is: {"odata.error":{"code":"-2147024891, System.UnauthorizedAccessException","message":{"lang":"de-DE","value":"Zugriff verweigert. Sie haben keine Berechtigung, diesen Vorgang auszuf\u00fchren oder auf diese Ressource zuzugreifen."}}} The request ID is: 62358e9f-c0aa-2000-8af6-6ac1e0ad3879 And the timestamp is: Mon, 16 Nov 2020 13:05:47 GMT I hope these are the information you need. - JBLConsult
The Requestid and timestamp that you gave is not valid. Please give a fresh requestid, timestamp for the failed http call. - Shiva Keshav Varma

1 Answers

0
votes

I think is has something to do with the "SharePoint Online Client Extensibility Web Application Principal".

  1. Go to https://portal.azure.com

  2. Open your Azure AD and goto "App registrations" (on the left)

  3. You should be able to find "SharePoint Online Client Extensibility Web Application Principal" under "All applications" enter image description here

  4. Open this application and go to "Expose an API" (on the left)

  5. Add a client application with the ID "00000003-0000-0ff1-ce00-000000000000" and check "https://microsoft.spfx3rdparty.com/user_impersonation" enter image description here