Tenant properties API GetStorageEntity not authorized to External Users

[luismanez]

Category

• Question
• Typo
• [ X] Bug
• Additional article idea

Expected or Desired Behavior

You can get a tenant property value using REST API (GetStorageEntity) even when the user is an external user.

Observed Behavior

I´m getting an UnauthorizedAccessException

Steps to Reproduce

• Add a tenant property
• Share a site with an external user, and log into the site
• From an spfx webpart, do a REST call to:

.../sites/SITE/_api/web/GetStorageEntity('PROPERTY_KEY')

you will get an UnauthorizedAccessException
Same steps with a "normal" user works as expected.

I guess this is because the Tenant properties are stored in the App Catalog site, where the external user has no access. I think it shouldn´t be the case, as a developers, we want to get Tenant properties from code, even if the user is an external user. Anyway, if this is by design, you should add the documentation and specify it

Thanks!

[VesaJuvonen]

Thx Luis, this is clearly a bug in the API caused by lack of elevation. The issue has been logged and scheduled to be addressed in a relatively fast timeline. Due SPO freeze period during holiday season, you can expect this to get fixed during January.

[luismanez]

Thanks for the detailed info Vesa, very appreciate it!

[GrahamMcMynn]

@luismanez - sorry to take so long to fix this. A fix is now being made and it should start rolling out to servers around the 26th of March.

[luismanez]

Thanks @mcmynn83, great news!

[GrahamMcMynn]

I am closing this issue, however, if it still doesn't work after the 26th please send me a message and I will re-open it. It has been validated in our test environments.

[sortegamartin]

@mcmynn83 - This problem keeps happening. When trying to recover a tenant property with an external user, the call returns an error 403. Is there a date planned to solve this bug?

[VesaJuvonen]

Reopen based on Graham's comment.