Error when adding a tenant about entracp

[Yvand]

The app registered on Azure probably misses permission "Read directory data".
Please follow this link to register the app correctly

[benjamingournay2]

The app registered on Azure has the permission "Read directory data".
Do you have any ideas what else it could be ?

[benjamingournay2]

Do we need to enable Microsoft Graph ? and to give permissions to that service ?

[Yvand]

Can you confirm that you did NOT grant "Read directory data" in delegated permissions?
For AzureCP to work you must grant only "Read directory data" under "Application permissions".
If you did otherwise and fix permissions afterwards, you need to wait for some time before you can check connection again in AzureCP, or you can register a new app set initially with the right permissions.

[benjamingournay2]

I granted Read directory data yesterday in application permissions and I did not grant anything in delegated permissions. This morning, I still have the issue unfortunately

[Yvand]

Just in case, can you try to register a new application, grant only "Read directory data" under "Application permissions" and test if it works?

[benjamingournay2]

We created a new app but still the same error:

[benjamingournay2]

Do you have an idea what can cause that issue in the sharepoint logs when I click "test tenant connection" ? I followed exactly what was said in the documentation. I tried both the last release and beta 3 versions but I always have the same issue:

[AzureCP] Unexpected error while testing connectivity: System.Data.Services.Client.DataServiceQueryException: An error occurred while processing this request., Callstack:
at System.Data.Services.Client.QueryResult.EndExecuteQuery[TElement](Object source, String method, IAsyncResult asyncResult)
at System.Data.Services.Client.DataServiceRequest.EndExecute[TElement](Object source, DataServiceContext context, String method, IAsyncResult asyncResult)
at System.Data.Services.Client.DataServiceQuery1.EndExecute(IAsyncResult asyncResult) at Microsoft.Azure.ActiveDirectory.GraphClient.Extensions.DataServiceContextWrapper.<>c__DisplayClass4c2.b__4a(IAsyncResult r)
at System.Threading.Tasks.TaskFactory1.FromAsyncCoreLogic(IAsyncResult iar, Func2 endFunction, Action1 endAction, Task1 promise, Boolean requiresSynchronization) --- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Runtime.CompilerServices.TaskAwaiter1.GetResult() at Microsoft.Azure.ActiveDirectory.GraphClient.Extensions.DataServiceContextWrapper.<ExecuteAsync>d__4e2.MoveNext()

[Yvand]

Can you ignore this error, add the connection and test directly the people picker?
You can monitor AzureCP activity in SharePoint logs if you filter on Product/Area "AzureCP"
If people picker doesn't work, can you try to update AzureCP with the latest Beta, which you can download here?

[benjamingournay2]

Hi Yvan, We have the following unexpected errors : [AzureCP] Validation with AAD lookup created 0 permissions instead of 1 expected. Aborting operation [AzureCP] Unexpected error while getting users in tenant hugge.onMicrosoft.com: System.Data.Services.Client.DataServiceQueryException: An error occurred while processing this request., Callstack: at System.Data.Services.Client.QueryResult.EndExecuteQuery[TElement](Object source, String method, IAsyncResult asyncResult) at System.Data.Services.Client.DataServiceRequest.EndExecute[TElement](Object source, DataServiceContext context, String method, IAsyncResult asyncResult) at System.Data.Services.Client.DataServiceQuery`1.EndExecute(IAsyncResult asyncResult) at Microsoft.Azure.ActiveDirectory.GraphClient.Extensions.DataServiceContextWrapper.<>c__DisplayClass4c`2.<ExecuteAsync>b__4a(IAsyncResult r) at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization) --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult() at Microsoft.Azure.ActiveDirectory.GraphClient.Extensions.DataServiceContextWrapper.<ExecuteAsync>d__4e`2.MoveNext() [AzureCP] ODataErrorException occurred while querying tenant 'hugge.onMicrosoft.com': Insufficient privileges to complete the operation., Callstack: at azurecp.AzureCP.<>c__DisplayClass27_0.<<QueryAzureADAsync>b__1>d.MoveNext(). [cid:[email protected]] Azure CP is in the people picker: [cid:[email protected]] There is no resolution (ADFS30 is our trusted provider for ADFS): [cid:[email protected]] The beta 3 is installed and tenant added: [cid:[email protected]] Thks for help, Best regards, De : Yvan Duhamel [mailto:[email protected]] Envoyé : mardi, 23 janvier 2018 08:57 À : Yvand/AzureCP <[email protected]> Cc : GOURNAY Benjamin <[email protected]>; Author <[email protected]> Objet : Re: [Yvand/AzureCP] Error when adding a tenant (#9) Can you ignore this error, add the connection and test directly the people picker? You can monitor AzureCP activity in SharePoint logs if you filter on Product/Area "AzureCP" If people picker doesn't work, can you try to update AzureCP<https://yvand.github.io/AzureCP/Update-AzureCP.html> with the latest Beta, which you can download here<https://github.com/Yvand/AzureCP/releases/tag/v10.Beta>? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<#9 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/Ah2IUfzEaeeDMa0rHCEVVCZ-o1MeVpWDks5tNZC2gaJpZM4RfoqL>.

[Yvand]

Error message is "Insufficient privileges to complete the operation", which should be resolved by granting "Read directory data" only under "Application permissions" (and not to delegate permissions).
I cannot explain why you keep getting this error after setting permissions like described above...

[Markus-MEEQIT]

Make sure you have actually granted the saved permissions in Azure Portal, by clicking the Grant Permissions button in the blade prior to the Enable Access blade. The portal is a bit confusing in that it first asks you to save permissions but you then also have to grant the saved permissions.

[joker-it]

i had the same error, after reinstall the solution and grant permission in Azure Portal it works fine...