SharePoint API permissions troubleshooting

This document will take you through the steps for fixing any problems you may encounter when activating the SharePoint API permissions required by DocRead.

You must be a Global Administrator in Microsoft Entra ID to complete these steps.

Introduction

When approving API permissions on the SharePoint API Access page in the SharePoint admin center, we are granting these permissions to the SharePoint Online Client Extensibility Web Application Principal in Microsoft Entra ID.

Unfortunately, there are several widely reported issues with the Microsoft API Access page where, under some circumstances, the page fails to update the principal permissions. This document will take you through the steps of updating the permissions directly on the SharePoint Online Client Extensibility Web Application Principal in Microsoft Entra ID.

Once you have completed the steps, you will be able to confirm that the permissions have been successfully applied by checking that they are displaying as approved on the API Access page.

Check existing permissions

  1. Go to the “App Registrations” page in “Microsoft Entra ID”.

  2. Under “All Applications” type “SharePoint” in the search box.

  3. Select the SharePoint Online Client Extensibility Web Application Principal.

    image-20241101155940767

  4. Select “API permissions” on the left.

  5. Check if the following three permissions are listed and are showing as granted

    You may have other permissions listed that will not need to be changed.

    image-20241102150048143

  6. If all the permissions are correctly displayed as shown above, then there is nothing to fix. If some of the permissions are missing or not showing as granted, then use the sections below to correct the problem.

Add missing permissions

This section will guide you on how to add the missing permissions. Please choose the section that is relevant to your situation:

Add missing DocReadApi/access_as_user permission

  1. Click on the “Add a permission” option: image-20241102152221693
  2. Select “APIs my organization uses”.
  3. In the filter box type “docread”.
  4. Select “DocReadApi” image-20241102154649588
  5. Select the “access_as_user” permission and click “Add permissions”. image-20241102155102895
  6. On the permissions list page, click “Grant consent for xxxxx” (where xxxxx is your tenant’s name). image-20241102155610317
  7. The permission should now be shown as granted: image-20241102155804450

Add missing Microsoft Graph/User.Read.All permission

  1. Click on the “Add a permission” option: image-20241102160435476
  2. Under Microsoft APIs select “Microsoft Graph”: image-20241102160637939
  3. Select “Delegated permissions”,
  4. In the search box type “user.read.all”. Under the permissions list select “User.Read.All” and click the “Add Permissions” button: image-20241102160751674
  5. On the permissions list page, click “Grant consent for xxxxx” (where xxxxx is your tenant’s name). image-20241102161851079
  6. The permission should now be shown as granted: image-20241102162107037

Add missing Microsoft Graph/Group.Read.All permission

  1. Click on the “Add a permission” option: image-20241102160435476
  2. Under Microsoft APIs select “Microsoft Graph”: image-20241102160637939
  3. Select “Delegated permissions”,
  4. In the search box type “group.read.all”. Under the permissions list select “Group.Read.All” and click the “Add Permissions” button: image-20241102160751674
  5. On the permissions list page, click “Grant consent for xxxxx” (where xxxxx is your tenant’s name). image-20241102162801079
  6. The permission should now be shown as granted: image-20241102162909276

If any (or all) of the required permissions listed in the “Check existing permissions” section, are showing as not granted, as in the example below, then click the “Grant consent for xxxxx” (where xxxxx is your tenant’s name) button.

image-20241102165217510