#entra-id 13 articles

• "The requested permission isn't valid" in API access — the API registration doesn't exist yetgotchas / spfxAPI access resolves resource to a service principal, so the app registration must exist before the .sppkg is uploaded
• accountEnabled eq false is not a list of leavers — blocked shared mailboxes are in it toogotchas / graphblocked members ≠ former employees; tell shared mailboxes apart via the mailbox usage report's recipientType (needs real names) or mailboxSettings.userPurpose (per user)
• signInActivity without Entra ID P1 — the retry without it turns "not measured" into "0 inactive users"gotchas / graphSelecting signInActivity on /users fails with 403 in tenants without Entra ID P1/P2; the common fallback (retry without the property) makes every user look "never signed in" or gets skipped, so inactive-user and…
• Adding or removing a group member via Graph needs the object ID — a UPN returns 400 "Invalid object identifier"gotchas / graphPOST /groups/{id}/members/$ref and DELETE /groups/{id}/members/{id}/$ref accept only the user's object ID (GUID); a UPN from a people picker returns 400 Invalid object identifier — resolve it with GET…
• An SPFx web part that calls an intranet API makes Chrome and Edge ask every user for local network accessgotchas / spfxA *.sharepoint.com page fetching a host that resolves to a private IP is a local network request – Chrome (from 142) and Edge prompt every user and a refusal is a bare Failed to fetch; pre-allow the SharePoint origin…
• GetUserEffectivePermissions ignores the user's Entra security groups — and Full Control's effective mask is not the role's maskgotchas / permissionsAsked on behalf of another user, GetUserEffectivePermissions counts Microsoft 365 group membership but not Entra security group membership — directly assigned or nested in a SharePoint group, still after 40 s — so it…
• GitHub Actions OIDC login to Azure fails with AADSTS700213 in repositories created after 15 July 2026gotchas / azure-functionsNew GitHub repositories send the OIDC subject as repo:owner@ownerId/repo@repoId:…, so an Azure federated credential written in the classic repo:owner/repo:… form never matches and azure/login fails with AADSTS700213.…
• perUserMfaState says "disabled" even when MFA is enforced — don't report it as "user has no MFA"gotchas / graphThe legacy per-user switch stays off while MFA is fully enforced; report on userRegistrationDetails instead — which omits blocked accounts and needs an undocumented Entra ID P1/P2 tenant
• Power Automate admin flows API returns UserImpersonationScopeMissing from SPFx – even after you approve the scopegotchas / spfxSharePoint's token for Microsoft Flow Service carries only Microsoft's preauthorized scopes, so an approved User grant never reaches the token and the tenant-wide flows list stays 401
• preAuthorizedApplications can't reference a scope created in the same PATCHgotchas / graphGraph checks delegatedPermissionIds against stored scopes; scope and its pre-authorization need two separate PATCH calls
• Rolling out required tokens on your own API: the "calls without a token" counter measures every client, not just the app you fixedgotchas / spfxYou add Entra ID token validation to an API your SPFx solutions call, ship it in soft mode and wait for "calls without a token" to reach zero — it never does, because a shared npm package, a second solution, a…
• The memberOf operator in dynamic group rules stops working on 3 November 2026 — groups freeze instead of failinggotchas / graphEntra ends the memberOf preview operator in dynamic membership rules on 3 Nov 2026 (MC1448379): affected groups, dynamic admin units and auto-assignment policies keep their last membership and never update again.…
• Which Entra ID roles are privileged? isPrivileged is beta-only, and a hand-written list gets it wronggotchas / graphRead isPrivileged live from beta roleDefinitions – v1.0 omits it and 400s on $select=isPrivileged; Exchange/SharePoint/Teams admins are not privileged