Granting user permission

[Ochechule]

Hi,
it seems that grating user permissions for site design doesn't work. I can see or remove permission granted using PowerShell (Grant-SPOSiteDesignRights), but when I try to add new user, he doesn't get recognised and just typing user name doesn't work.

Tested in two independent tenants. App version 2.0.1.0.

[ypcode]

Hi @Ochechule

Thank you for reporting, would it be possible for you to share the content of you console log and network trace (specifically the calls to Microsoft Graph) ?

I’ll have a look and try to find out the reasons and will eventually come up with some fixes

Regards,
Yannick

[Ochechule]

Hi Yannick, logs are attached. It's from my dev tenant. Console log contains events for the whole page load. Errors related to the people picker are at the end starting with: Access to XMLHttpRequest at ' https://waconatm.officeapps.live.com/apc/trans.gif?c6c77943f6dba9426ab8b446ccd46eb3' from origin 'https://devhivelab.sharepoint.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Obviously something with permissions. I was logged as tenant admin. Network log captures just what appears when the page is already fully loaded and I try to use the peoplepicker. Kind regards, Pavel (Ochechule) ne 21. 6. 2020 v 10:09 odesílatel Yannick Plenevaux < [email protected]> napsal:

…

Hi @Ochechule <https://github.com/Ochechule> Thank you for reporting, would it be possible for you to share the content of you console log and network trace (specifically the calls to Microsoft Graph) ? I’ll have a look and try to find out the reasons and will eventually come up with some fixes Regards, Yannick — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#5 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/APXM2AOPJFUEYXFVUAYX3ZDRXUXRTANCNFSM4OBFPRPQ> .

[sparkitect]

Is the Office Graph disabled on the tenancy? Get Outlook for Android<https://aka.ms/ghei36>

________________________________ From: Ochechule <[email protected]> Sent: Saturday, June 20, 2020 9:03:22 PM To: pnp/sp-site-designs-studio <[email protected]> Cc: Subscribed <[email protected]> Subject: Re: [pnp/sp-site-designs-studio] Granting user permission (#5) Hi Yannick, logs are attached. It's from my dev tenant. Console log contains events for the whole page load. Errors related to the people picker are at the end starting with: Access to XMLHttpRequest at ' https://waconatm.officeapps.live.com/apc/trans.gif?c6c77943f6dba9426ab8b446ccd46eb3' from origin 'https://devhivelab.sharepoint.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Obviously something with permissions. I was logged as tenant admin. Network log captures just what appears when the page is already fully loaded and I try to use the peoplepicker. Kind regards, Pavel (Ochechule) ne 21. 6. 2020 v 10:09 odesílatel Yannick Plenevaux < [email protected]> napsal:

Hi @Ochechule <https://github.com/Ochechule> Thank you for reporting, would it be possible for you to share the content of you console log and network trace (specifically the calls to Microsoft Graph) ? I’ll have a look and try to find out the reasons and will eventually come up with some fixes Regards, Yannick — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#5 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/APXM2AOPJFUEYXFVUAYX3ZDRXUXRTANCNFSM4OBFPRPQ> .

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub<#5 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ACGHYGAAHLJ446FBRY3BKJ3RXWBAVANCNFSM4OBFPRPQ>.

[Ochechule]

Hi Jim, it was in its default state. I haven't used Graph till now. When I opened Graph Explorer, https://developer.microsoft.com/en-us/graph/graph-explorer, it asked for permissions to sign in. I gave it also other permissions that seemed related (like User.Read.All - Read all users' full profiles), but still it's not working. Do you know what permissions are needed? Regards, Pavel ne 21. 6. 2020 v 17:12 odesílatel Jim Duncan <[email protected]> napsal:

…

Is the Office Graph disabled on the tenancy? Get Outlook for Android<https://aka.ms/ghei36> ________________________________ From: Ochechule ***@***.***> Sent: Saturday, June 20, 2020 9:03:22 PM To: pnp/sp-site-designs-studio ***@***.***> Cc: Subscribed ***@***.***> Subject: Re: [pnp/sp-site-designs-studio] Granting user permission (#5) Hi Yannick, logs are attached. It's from my dev tenant. Console log contains events for the whole page load. Errors related to the people picker are at the end starting with: Access to XMLHttpRequest at ' https://waconatm.officeapps.live.com/apc/trans.gif?c6c77943f6dba9426ab8b446ccd46eb3 ' from origin 'https://devhivelab.sharepoint.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Obviously something with permissions. I was logged as tenant admin. Network log captures just what appears when the page is already fully loaded and I try to use the peoplepicker. Kind regards, Pavel (Ochechule) ne 21. 6. 2020 v 10:09 odesílatel Yannick Plenevaux < ***@***.***> napsal: > Hi @Ochechule <https://github.com/Ochechule> > > Thank you for reporting, would it be possible for you to share the content > of you console log and network trace (specifically the calls to Microsoft > Graph) ? > > I’ll have a look and try to find out the reasons and will eventually come > up with some fixes > > Regards, > Yannick > > — > You are receiving this because you were mentioned. > Reply to this email directly, view it on GitHub > < #5 (comment) >, > or unsubscribe > < https://github.com/notifications/unsubscribe-auth/APXM2AOPJFUEYXFVUAYX3ZDRXUXRTANCNFSM4OBFPRPQ > > . > — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub< #5 (comment)>, or unsubscribe< https://github.com/notifications/unsubscribe-auth/ACGHYGAAHLJ446FBRY3BKJ3RXWBAVANCNFSM4OBFPRPQ >. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#5 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/APXM2AMOAMZSVOY6Q7TEUE3RXWJD5ANCNFSM4OBFPRPQ> .

[ypcode]

@Ochechule

Regarding the logs I see no attachment in your reply, (if you attached it responding via e-mail, I don't think GitHub supports it... Could you please share it via other means (e.g. OneDrive link) ?)

Each application to Microsoft Graph has its own set of permissions, in the case of Site Designs Studio, the application that needs to be granted the permissions to MS Graph is SharePoint Online principal.
If you installed with the setup.ps1 script and did not see any error, the required permissions should have been granted.
To make sure of it you can go to

https://yourtenant-admin.sharepoint.com/_layouts/15/online/AdminHome.aspx#/webApiPermissionManagement
(Replace yourtenant accordingly)

In the Approved requests group, you should see

[Ochechule]

I'm sorry, I used the email attachment. Anyway your advice solved the problem. I haven't noticed any error during installation, but the permission request was waiting for approval. Once I approved it, people picker started to work and changes were saved. I can see the same pending request in my customer's tenant (I'm not admin there, so I can't approve it at this moment).  Thank you very much for your help. Regards, Pavel (Ochechule) ne 21. 6. 2020 v 22:26 odesílatel Yannick Plenevaux < [email protected]> napsal:

…

@Ochechule <https://github.com/Ochechule> Regarding the logs I see no attachment in your reply, (if you attached it responding via e-mail, I don't think GitHub supports it... Could you please share it via other means (e.g. OneDrive link) ?) Each application to Microsoft Graph has its own set of permissions, in the case of Site Designs Studio, the application that needs to be granted the permissions to MS Graph is SharePoint Online principal. If you installed with the setup.ps1 script and did not see any error, the required permissions should have been granted. To make sure of it you can go to https://*yourtenant*- admin.sharepoint.com/_layouts/15/online/AdminHome.aspx#/webApiPermissionManagement (Replace *yourtenant* accordingly) In the Approved requests group, you should see [image: image] <https://user-images.githubusercontent.com/8345556/85222184-803ca080-b3b9-11ea-8a79-de7467e80e05.png> — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#5 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/APXM2AJE3JIOYWK2WGROM23RXXN4TANCNFSM4OBFPRPQ> .

[ypcode]

Hi @Ochechule , can I then close this issue ?

[Ochechule]

Hi @ypcode, yes, you can.
My problem was that I didn't know it's necessary to approve API access through https://tenant-admin.sharepoint.com/_layouts/15/online/AdminHome.aspx#/webApiPermissionManagement
Thanks.

[ypcode]

The setup script should indeed automatically approve the API permissions...
I will leave this open until I have a chance to double-check it :)

[Ochechule]

I installed it in 3 tenants. In one I was global admin, in two just SharePoint admin. We had to approve permissions in all three tenants manually. Not a big deal when you know what to do :)