Scenario

You are trying to register an application at SharePoint site with appregnew.aspx page and you are getting an error or notification message “Your SharePoint tenant admin doesn’t allow site collection admins to create an Azure Access Control (ACS) principal“.

You are trying to provide ACS-based permissions for an application to SharePoint site with appinv.aspx page and you are getting “Your SharePoint tenant admin doesn’t allow site collection admins to update app permissions. Please contact your SharePoint administrator.”

You can still view and even delete your apps permissions from /_layouts/15/appprincipals.aspx page:

Reason

This is due to a recent update to Microsoft 365 (tenant governance security measures enhancement MC660075) implemented by Microsoft in Aug/Sep 2023. According to the update, only tenant administrators can create or update ACS service principal by default.

The root cause for this is that the Microsoft is pushing developers out of that legacy ACS-based SharePoint Apps-only service principals towards Azure-registered applications with Sites.Selected API permissions as they are more secure etc.

Key differences ASC vs Sites.Selected are:

ACS-based SharePoint app/permissions	Apps registered in Azure with Sites.Selected API permissions
support authentication with client secret only, secret is valid for 1 year exactly	support authentication with client secret and certificate, custom expiration time
support granular access to SharePoint at the site-level e.g. to site collection or web or a specific list	support only access to entire site collection (but Microsoft is working on granular access)
support only classic SharePoint REST API and CSOM	support both – classic SharePoint REST API and CSOM and Microsoft Graph API
app id (client id) is created via appregnew.aspx at a specific SharePoint site by site collection administrator	app id (client id) is created in Azure portal, API Sites.Selected permissions are configured via Azure portal and require tenant admin consent
permissions for the app to a site are provided at the site by site collection administrator via appinv.aspx page	permissions for the App to to a specific SharePoint site are provided by SharePoint admin with PowerShell script or Graph API calls

Solution #1 – switch to Sites.Selected

1. Register an application in Azure (via Azure portal GUI, PowerShell script or your company’s specific helpdesk/servicedesk request)
2. Update the app so both – MS Graph API Sites.Selected and SharePoint Sites.Selected permissions are configured and
3. API permissions must be consented – so you’d seek/request your tenant admin consent
4. Obtain and upload client certificate (recommended) or generate client secret
5. Request access for the app to a specific SharePoint site (your SharePoint service admin should be able to do that)
6. Validate your app has access to the target SharePoint site with PowerShell
7. Secure your certificate and/or secret

If you are hosting your application in Azure – consider using managed identity.

In some cases Sites.Selected permissions are not enough to get access to SharePoint (example – Azure data Factory).

Solution #2 – admin to register/update an ACS app

Notice how Microsoft explains it in MC660075 in Message Center “site collection admin will be unable to register app or update app permissions through above pages unless authorized explicitly by the SharePoint tenant admin” and “With this update site owners will not be able to register/update apps unless the tenant admin explicitly allows it.”

Based on that explanation we might think that there must be an option for tenant admin to register an app or to allow registering specific app not changing the entire default behavior back…

But there was no such option (!) in the middle of October 2023, when this feature was enabled at all tenants. Even having a SharePoint admin or tenant admin permissions – if you tried to register an app with AppRegNew.aspx – you got the same error message “Your SharePoint tenant admin doesn’t allow site collection admins to…”.

As of today (Nov 6, 2023) it seems like Microsoft has implemented it! E.g. now SharePoint or tenant admin is able to register an app with AppRegNew.aspx or update it with AppInv.aspx at any specific site collection.

So, if ACS-based permissions are required for app here you go:

• activate your SharePoint service/tenant admin role
• ensure you are also target site collection administrator
• navigate to “https://yourtenant.sharepoint.com/sites/yoursite/_layouts/15/appinv.aspx” and provide
  • Azure registered app (client) Id for lookup
  • localhost as app domain
  • https://localhost as redirect url
  • Permission Request XML – depending on permissions you need, e.g. for full app access to entire site collection:

<AppPermissionRequests AllowAppOnlyPolicy="true">  
   <AppPermissionRequest Scope="http://sharepoint/content/sitecollection" 
    Right="FullControl" />
</AppPermissionRequests>

Solution #3 – step back (not recommended)

Surely you can switch back this new default behavior that prevents site collection admin to register/update apps at SharePoint. This is done with PowerShell command

Set-SPOTenant -SiteOwnerManageLegacyServicePrincipalEnabled $true

To run this command – you’d need to be a SharePoint service/tenant admin.

But this will be a setback on your path to improving m365 tenant safety, as after that you’ll have a service principals out of control again. So this solution is not recommended.

In case you really need an ACS-based service principal – there is Solution number 2

Full text of Microsoft’s MC660075 message

(Updated) SharePoint admin control for App registration / update

Tag
MAJOR UPDATE ADMIN IMPACT FEATURE UPDATE

Message Summary
Updated August 30, 2023: We have updated the content below for clarity. Thank you for your patience.

This is an enhancement to the security measures for administrative governance that modifies the default procedures for SharePoint app registration via AppRegNew.aspx page and permission updates via AppInv.aspx page. Following the implementation of this change, site collection admin will be unable to register app or update app permissions through above pages unless authorized explicitly by the SharePoint tenant admin.

Upon attempting to register an application on AppRegnew.aspx page, a notification will be displayed stating “Your SharePoint tenant admin doesn’t allow site collection admins to create an Azure Access Control (ACS) principal. Please contact your SharePoint tenant administrator.”

Similarly, upon attempting to update app permissions on AppInv.aspx page, a notification will be displayed stating “Your SharePoint tenant admin doesn’t allow site collection admins to update app permissions. Please contact your SharePoint tenant administrator.”

Kindly note that app registration and permission update via Microsoft Azure portal are not impacted by this change.

When this will happen:

The rollout process is scheduled to commence in late August and is expected to conclude in mid-September.

How this will affect your organization:

With this update site owners will not be able to register/update apps unless the tenant admin explicitly allows it.

To modify the default behavior, the tenant administrator must execute the following shell command to explicitly establish the flag as TRUE, thereby superseding the default value of FALSE. The service principal can only be created or updated by the tenant administrator by default. However, when the flag is set to TRUE, both the SharePoint tenant admin and site collection admin will be able to create or update the service principal through SharePoint.

The shell command is: Set-SPOTenant -SiteOwnerManageLegacyServicePrincipalEnabled $true

Note: The property ‘SiteOwnerManageLegacyServicePrincipalEnabled’ becomes visible in tenant settings after SharePoint Online Management shell is updated to 16.0.23710.12000 or a later version. But before this rollout, the value will always be TRUE even explicitly set to FALSE. It will only automatically be switched to FALSE as the default value after the rollout is launched.

What you need to do to prepare:

No proactive measures are required to prepare for this change. Nevertheless, it is advisable to inform your users of this modification and update any relevant documentation as necessary.