starred/CIPP

Fork 0

mirror of https://github.com/KelvinTegelaar/CIPP.git synced 2026-04-25 08:16:01 +03:00

[GH-ISSUE #3989] [Bug]: Deploying multiple multitenant Apps in one standard Fails to apply permissions #1793

New issue

Closed

opened 2026-03-02 13:47:07 +03:00 by kerem · 4 comments

kerem commented

2026-03-02 13:47:07 +03:00

Owner

Originally created by @mruiterHU on GitHub (Apr 18, 2025).
Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/3989

Required confirmations before submitting

I can reproduce this issue on the latest released versions of both CIPP and CIPP-API.
I have searched existing issues (both open and closed) to avoid duplicates.
I am not requesting general support; this is an actual bug report.

Issue Description

We have two multitenant applications originating from our partner tenant, each serving a different use case. Until now, we’ve been deploying them using two separate standards:

One standard with Deploy Application X
Another standard with Deploy Application Y

This setup works as expected, both apps are successfully deployed to the target tenants with the correct permissions (see screenshot for reference).

The Issue
We would now like to reorganize and consolidate these into a single standard that deploys both applications. According to the documentation, this should be possible by using a comma-separated list of App IDs in the standard.

However, when running the standard with both App IDs:

The service principals are created in the target tenant.
But the permissions are not applied.
Re-running the standard has no effect — permissions remain missing.
The following error is shown in the logbook (see attached screenshot):
Failed to add app (appid). Error: Invalid object identifier 'oauth2PermissionGrants'.

rvdwegen suggested the issue might be related to how $AppExists is handled in the script.

Additional Information

Both applications are multitenant apps created in our partner tenant.
They’ve been in use for several months via their own individual standards.
When deployed individually, they are added with the correct permissions no issues.
The problem only occurs when combining both apps into one standard using the comma-separated list.

sponsering via: https://github.com/hypecipp

Environment Type

Front End Version

7.5.1

Back End Version

7.5.1

Relevant Logs / Stack Trace

Originally created by @mruiterHU on GitHub (Apr 18, 2025). Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/3989 ### Required confirmations before submitting - [x] **I can reproduce this issue on the latest released versions** of both CIPP and CIPP-API. - [x] **I have searched existing issues** (both open and closed) to avoid duplicates. - [x] I am **not** requesting general support; this is an actual bug report. ### Issue Description We have two multitenant applications originating from our partner tenant, each serving a different use case. Until now, we’ve been deploying them using two separate standards: - One standard with Deploy Application X - Another standard with Deploy Application Y This setup works as expected, both apps are successfully deployed to the target tenants with the correct permissions (see screenshot for reference). **The Issue** We would now like to reorganize and consolidate these into a single standard that deploys both applications. According to the documentation, this should be possible by using a comma-separated list of App IDs in the standard. ![Image](https://github.com/user-attachments/assets/2868016d-0547-4e12-8f49-c45e2845574f) However, when running the standard with both App IDs: - The service principals are created in the target tenant. - But the permissions are not applied. - Re-running the standard has no effect — permissions remain missing. - The following error is shown in the logbook (see attached screenshot): Failed to add app (appid). Error: Invalid object identifier 'oauth2PermissionGrants'. ![Image](https://github.com/user-attachments/assets/921ca71e-d0ac-4431-a6b9-8b77e21b748c) rvdwegen suggested the issue might be related to how $AppExists is handled in the script. **Additional Information** - Both applications are multitenant apps created in our partner tenant. - They’ve been in use for several months via their own individual standards. - When deployed individually, they are added with the correct permissions no issues. - The problem only occurs when combining both apps into one standard using the comma-separated list. ![Image](https://github.com/user-attachments/assets/4cba9e4d-8e44-4c96-a8dd-9aa2876ec2ab) sponsering via: https://github.com/hypecipp ### Environment Type Sponsored (paying) user ### Front End Version 7.5.1 ### Back End Version 7.5.1 ### Relevant Logs / Stack Trace ```plaintext ```

kerem

2026-03-02 13:47:07 +03:00

closed this issue
added the
bug

unconfirmed-by-user

not-assigned
labels

kerem commented

2026-03-02 13:47:08 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Apr 18, 2025):

Thank you for reporting a potential bug. If you would like to work on this bug, please comment:

I would like to work on this please!

Thank you for helping us maintain the project!

@github-actions[bot] commented on GitHub (Apr 18, 2025): Thank you for reporting a potential bug. If you would like to work on this bug, please comment: > I would like to work on this please! Thank you for helping us maintain the project!

kerem commented

2026-03-02 13:47:09 +03:00

Author

Owner

@ndit-dev commented on GitHub (Apr 18, 2025):

+1 started deploying two apps through standards today, first app worked as expected. But get the same error as OP when the second app is added

@ndit-dev commented on GitHub (Apr 18, 2025): +1 started deploying two apps through standards today, first app worked as expected. But get the same error as OP when the second app is added

kerem commented

2026-03-02 13:47:09 +03:00

Author

Owner

@Zacgoose commented on GitHub (May 2, 2025):

+1 as well, might have a look into this if I get time

@Zacgoose commented on GitHub (May 2, 2025): +1 as well, might have a look into this if I get time

kerem commented

2026-03-02 13:47:09 +03:00

Author

Owner

@KelvinTegelaar commented on GitHub (May 28, 2025):

We've made massive changes to how this works, fixed in dev, but I recommend switching over to templates instead of comma separated :)

@KelvinTegelaar commented on GitHub (May 28, 2025): We've made massive changes to how this works, fixed in dev, but I recommend switching over to templates instead of comma separated :)

kerem referenced this issue

2026-03-02 13:58:15 +03:00

[PR #1793] [CLOSED] TenantID in Alerts #3419

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/CIPP#1793

No description provided.

Rows
Columns