Skip to content

Creating service principal for App Registration - incorrect error when you're too quick #3195

Open

Description

@ssteiner

Describe the bug

My application is creating App Registrations, Service Principals for that app Registration, and then assigns permissions to the Service Principal.. Stripped down to the barebones, this is the code that's being run

` var app = await graph.Applications.PostAsync(
new Application { DisplayName = displayName, SignInAudience = "AzureADMyOrg" }).ConfigureAwait(false);

var sp = await graph.ServicePrincipals.PostAsync(
new ServicePrincipal { AppId = app.AppId }).ConfigureAwait(false);`

While the first PostAsync runs fine, the second returns the following error:

Authorization_RequestDenied - When using this permission, the backing application of the service principal being created

This error is incorrect - the Service Principal Creation is of course being done in the same tenant as the App Registration. However, turns out the issue is (as so often) timing. I've then added an App Registration extraction with retries -

var result = await graph.Applications[objectId].GetAsync(cancellationToken: ct).ConfigureAwait(false);

And repeat that line until I get a result, then run the service principal creation, and as expected, things work fine.

So, the error returned by the SP creation is incorrect - is should instead return a 'not found' error

Expected behavior

Return a 'not found' error when the App Registration cannot be found when trying to create the Service Principal

How to reproduce

See code snipped in the bug description.

Node that I'm not using the Graph SDK directly bur rather Microsoft.Identity.Web.GraphServiceClient v 4.16.1. It is registered as follows

builder.Services.AddScoped(sp => new GraphServiceClient(new DefaultAzureCredential(), ["https://graph.microsoft.com/.default"]));`

SDK Version

5.51.0

Latest version known to work for scenario above?

No response

Known Workarounds

Try extracting the created application until found before continuing to create the Service Principal

Debug output

Click to expand log ```
</details>


### Configuration

_No response_

### Other information

_No response_

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    status:waiting-for-triageAn issue that is yet to be reviewed or assignedtype:bugA broken experience

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions