Grant Failure on Newly Created App Instance
Grant Failure on Newly Created App Instance
If you are setting up the Microsoft Office 365 OneDrive or SharePoint instance for the first time on a new Microsoft Office 365 account, the grant may fail. Microsoft has recently disabled apps using an Azure Access Control (ACS) app-only access token by default. If so, follow the steps below to grant access successfully.
You can change the behavior by running set-SPOTenant -DisableCustomAppAuthentication $false (needs the latest SharePoint admin PowerShell). To do so, follow the steps below:
Note
The following steps are performed on a Windows device.
- Install the latest version of PowerShell on Windows. Follow the instructions here.
- Start PowerShell as an administrator on the Windows device, and run the following commands:
- Install-Module -Name Microsoft.Online.Sharepoint.PowerShell
- Import-Module Microsoft.Online.Sharepoint.PowerShell
- $adminUPN=“<the full email address of the global administrator account, example: admin@sumoskope.onmicrosoft.com>”
Note
Fill in the value for the $adminUPN variable (replacing all the text between the quotes, including the < and > characters).
- $orgName=“<name of your Office 365 organization, example: sumoskope>”
Note
Fill in the value for the $orgName variable (replacing all the text between the quotes, including the < and > characters).
- $userCredential = Get-Credential -UserName $adminUPN -Message “<type the password>”
Note
When prompted with the Windows PowerShell credential request dialog box, type the password for the global administrator account.
- To check the value of DisableCustomAppAuthentication, run the following commands:
- Connect-SPOService -Url https://$orgName-admin.sharepoint.com
Note
If you get an error message, run the command in step 2b followed by the -UseWindowsPowerShell parameter i.e., Import-Module Microsoft.Online.Sharepoint.PowerShell -UseWindowsPowerShell. And then run the Connect-SPOService -Url https://$orgName-admin.sharepoint.com command.
- get-SPOTenant
Look for the DisableCustomAppAuthentication parameter. It should be set to True.
Note
If you do not see the DisableCustomAppAuthentication parameter, execute the Install-Module -Name Microsoft.Online.Sharepoint.PowerShell -Force command and follow the steps from 2b.
- Connect-SPOService -Url https://$orgName-admin.sharepoint.com
- Run the following command to set the DisableCustomAppAuthentication value to false:
- set-SPOTenant -DisableCustomAppAuthentication $false
- Verify that the parameter is set to false. To do so, run the following command:
- get-SPOTenant
Look for the DisableCustomAppAuthentication parameter. It should be set to False.
- get-SPOTenant
Once you have set the value of DisableCustomAppAuthentication to false, go back to the Netskope UI and grant access.