Over the weekend, we started seeing errors in SharePoint online backups for all the tenants we backup with the error: “ Failed to validate any of the configured Azure Apps against the SharePoint Tenant Admin site. 1) Please verify the SharePoint Tenant Admin Url. 2) Please check the credentials and permissions for the configured apps. 3) Please ensure Custom App authentication is enabled on the SharePoint tenant.<br/>Source: xx, Process: SharePoint”
From logs on the Access Node:
CheckOffice365CredModern - Office365 app credentials incorrect :
CheckOffice365CredModern - Error is: The remote server returned an error: (401) Unauthorized.
What we have done
- Verified the Azure App secrets are not expired
- Verified DisableCustomAppAuthentication on the tenant is set to false
- Verified Azure app API permissions:
- Microsoft Graph: Application.ReadWrite.All, Application.ReadWrite.OwnedBy, Directory.Read.All, Group.ReadWrite.All, Policy.Read.All, RoleManagement.ReadWrite.Directory, Sites.FullControl.All, Sites.Read.All, User.ReadWrite.All
- SharePoint: Sites.FullControl.All, User.Read.All
I understand that Microsoft has deprecated ACS authorization and that new Graph APIs are required, but those permissions have all been granted per https://kb.commvault.com/article/?id=83163
I have also checked https://kb.commvault.com/article/?id=84896 and for versions 11.34 and earlier is states “With this value set to false you can now create App Registrations for SharePoint Online without the need of a certificate” (which we have set). Unfortunately, we aren’t able to upgrade to 11.36 due to other dependencies.
We have opened a ticket with support and they have told us this is due to the ACS deprecation. Why would this start occurring now, and not April 2nd?
