Cannot write to Site Collection TenantWideExtensions List with app-only credentials (ClientId + Certificate)

[pol-stewart]

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

SharePoint CSOM

Developer environment

Windows

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

• PnP.Framework 1.9.0 NuGet in C# CSOM (.Net 6)
• PnP.PowerShell 3.3.0 for quick tests in PowerShell

Describe the bug / error

We have a backend process that creates Site Collections and then tries to write into the Site Collection Tenant Wide Extensions list to configure an Extension application installed in the Tenant App Catalog. We write in that list using CSOM.

The context is authenticated using a ClientId and a Certificate of an App Registration in EntraID which has the Sites.FullControl.All permission. This was working fine until a few days ago.

Now it just fails with the message: "Must have Manage Web Site permissions in order to add apps to Site Collection App Catalog".

I have tried testing the same action with PnP.PowerShell and the same error happens:

I have also tried using a different App Registration with Sites.Selected permission and giving Full Control to the created Site Collection and the Site Collection of the Tenant App Catalog, but the same message appears.

What works is connecting as a user that has Full Control on the created Site Collection. But our backend process authenticates with app-only credentials.

Is this a bug? Is this an intended change?

Thank you.

Steps to reproduce

1. Install an Extension Application in the Tenant App Catalog.
2. Create a test Site Collection with its own App Catalog enabled.
3. Authenticate in that Site Collection using PnP.PowerShell with Connect-PnPOnline and a ClientId + Certificate of an App Registration with Sites.FullControl.All permission.
4. Do an Add-PnPListItem that writes into the Tenant Wide Extensions list of the created Site Collection using the ComponentId of the installed Extension.

Expected behavior

The following error message will be thrown by the Add-PnPListItem: "Must have Manage Web Site permissions in order to add apps to site collection app catalog"

[chr-sad]

We see the exact same error in our DevOps pipeline since 2026/07/19. On 2026/07/17 and before the exact same pipeline worked.

[Ashlesha-MSFT]

Hi all,

I re-ran the end-to-end repro today using the same app-only (ClientId + certificate) flow against Tenant Wide Extensions, but I could not reproduce the issue anymore. In my test, both delegated and app-only writes succeeded. I will tag the engineering team to confirm whether any backend behavior changed.

[chr-sad]

@Ashlesha-MSFT thanks for the update. I just tried it again on our side and I could not reproduce the issue anymore either. I tried it two times in different tenants, all worked as expected .

[jansenbe]

This was related to #10955 which got fixed. Closing this issue as well

[pol-stewart]

It's still not working on our tenants. Bert Jansen (@jansenbe)

Can we see your app registration configuration that you used to test it? Christoph Sadleder (@chr-sad)

[nicolaor]

We are seeing this issue since last Friday on multiple tenants.

We update a specific TenantWideExtension with app-only credentials and always get the misleading error: "Must have Manage Web Site permissions in order to add apps to site collection app catalog"

Here the error and ClientRequestId of one occurrence:

HttpResponseCode: 500
Code: Microsoft.SharePoint.SPException
Message: Must have Manage Web Site permissions in order to add apps to site collection app catalog
ClientRequestId: d8ee2da2-e02f-1001-9d1b-20eb20714bb9
SPClientServiceRequestDuration: 97
X-SharePointHealthScore: 1
X-SP-SERVERSTATE: ReadOnly=0