[Regression] App-only Sites.FullControl.All cannot create or update TenantWideExtensions after #10955/#10963 fix

[nicolaor]

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

SharePoint CSOM

Developer environment

Windows

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

• PowerShell 7.6.3
• PnP.PowerShell 3.1.0
• Authentication: Entra ID application with a certificate
• SharePoint application permission: Sites.FullControl.All
• Admin consent granted
• Tenant app catalog

Describe the bug / error

This appears to be a regression or an incomplete rollout of the fix associated with #10955 and #10963.

#10963 was closed on July 28, 2026 because #10955 was reported as fixed. On August 4, 2026, we reproduced the same failure using a newly created Entra application and certificate against our tenant app catalog.

Our production process fails while updating an existing TenantWideExtensions item through PnP.Core. A separate minimal PnP.PowerShell test also fails while creating a new disabled temporary item. Both operations fail with:

HttpResponseCode: 500
Code: Microsoft.SharePoint.SPException
Message: Must have Manage Web Site permissions in order to add apps to site collection app catalog

For the isolated reproduction we verified all of the following:

• The Entra application had the SharePoint Sites.FullControl.All application role.
• Admin consent was granted.
• The issued SharePoint access token contained the Sites.FullControl.All role.
• Certificate-based application authentication succeeded.
• Application context successfully resolved the tenant app catalog.
• Application context successfully read the hidden TenantWideExtensions list.
• CREATE of a disabled temporary extension failed with the permission exception.
• No list item was created, so the test could not proceed to UPDATE.

Question

Could the SharePoint engineering team confirm whether the fix for #10955 has reached all tenants and whether certificate-based application writes to TenantWideExtensions are still supported with the SharePoint Sites.FullControl.All application role?

The tenant identifiers, full raw transcript, and additional correlation information can be provided privately to Microsoft Support if required.

Steps to reproduce

1. Create an Entra ID application and a certificate.
2. Grant the application the SharePoint application permission Sites.FullControl.All.
3. Grant tenant-wide admin consent.
4. Connect to the SharePoint tenant app catalog using the application client ID and certificate.
5. Read the hidden TenantWideExtensions list to confirm the application context can access it.
6. Attempt to create a temporary disabled extension entry using a new component GUID, for example:

$values = @{
    Title                                  = "App-only TenantWideExtensions repro"
    TenantWideExtensionComponentId         = [guid]::NewGuid()
    TenantWideExtensionComponentProperties = '{"test":"create"}'
    TenantWideExtensionLocation            = 'ClientSideExtension.ApplicationCustomizer'
    TenantWideExtensionDisabled            = $true
    TenantWideExtensionSequence            = 65535
}

Add-PnPListItem -List "TenantWideExtensions" -Values $values -Connection $connection

7. Observe the HTTP 500 Microsoft.SharePoint.SPException.

Attached is a sample powershell script with which we can reproduce the issue on multiple tenants (all the ones we executed it against actually)

Test-TenantWideExtensionAppOnly.txt

Expected behavior

An Entra application holding the SharePoint Sites.FullControl.All application role should be able to create and update entries in the tenant app catalog's TenantWideExtensions list using certificate-based application context.

Actual behavior

Reading the list succeeds, but a write fails with an error requiring Manage Web Site permission even though the access token contains the SharePoint Sites.FullControl.All application role.

Exact output from the isolated test:

UTC time        : 2026-08-04T14:28:57.7830390Z
PowerShell      : 7.6.3
PnP.PowerShell  : 3.1.0
Auth mode       : Entra ID application + certificate
Permission      : SharePoint Sites.FullControl.All (application)

Tenant app catalog resolved successfully.
TenantWideExtensions list read succeeded.
CREATE          : starting

TEST RESULT     : failed
Exception type  : System.Exception
Message         : Must have Manage Web Site permissions in order to add apps to site collection app catalog
Repro invocation failure: Must have Manage Web Site permissions in order to add apps to site collection app catalog

An occurrence from the production UPDATE operation returned:

HttpResponseCode: 500
Code: Microsoft.SharePoint.SPException
Message: Must have Manage Web Site permissions in order to add apps to site collection app catalog
ClientRequestId: d8ee2da2-e02f-1001-9d1b-20eb20714bb9
SPClientServiceRequestDuration: 97
X-SharePointHealthScore: 1
X-SP-SERVERSTATE: ReadOnly=0