Updating requestedAccessTokenVersion property in app registration manifest results in error

Question

Updating requestedAccessTokenVersion property in app registration manifest results in error

Georgii Bogdanov 20

When i try to update the requestedAccessTokenVersion property from null to 2 in app registration Microsoft Graph App Manifest, I get the following error message:

"Failed to update 'xxxx' application. Error detail: No other properties may be modified when certification properties are being modified"

User's image

App registration is connected to Teams app published to Teams Store and currently doesn't undergo any certification/publishing process

Accepted answer

0 additional answers

Your answer

Answer 1

Obinna Ejidike 740

Hi Georgii

Thanks for using QandA platform.

The requestedAccessTokenVersion specifies the access token version expected by the resource. Can you confirm if the signInAudience on the application is configured as AzureADandPersonalMicrosoftAccount or PersonalMicrosoftAccount because this is a requirement if the value for this property must be set to 2.

Find documentation: https://learn.microsoft.com/en-us/entra/identity-platform/reference-microsoft-graph-app-manifest

Additionally, please ensure have no more than two key credentials and no more than two password credentials if the signInAudience on the application is configured as AzureADandPersonalMicrosoftAccount or PersonalMicrosoftAccount before updating the requestedAccessTokenVersion property.

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Obinna

Georgii Bogdanov 20 Reputation points

2025-04-02T13:01:11.74+00:00

Hi, signInAudience is set to AzureADMultipleOrgs. It is not required to set signInAudience to either AzureADandPersonalMicrosoftAccount or PersonalMicrosoftAccount to be able to set requestedAccessTokenVersion to 2. According to the link that you sent (requestedAccessTokenVersion description), requestedAccessTokenVersion=2 is required value in case signInAudience is either AzureADandPersonalMicrosoftAccount or PersonalMicrosoftAccount, so if signInAudience is AzureADMultipleOrgs, requestedAccessTokenVersion can be either null, 1 or 2. It is verified in other app registrations that we use that are not connected to Teams apps published to Teams store.
Obinna Ejidike 740 Reputation points

2025-04-02T13:17:31.1033333+00:00

Hi Georgii,

You're correct that requestedAccessTokenVersion can be set to 2 even when signInAudience is AzureADMultipleOrgs. The restriction mentioned in the documentation applies only when signInAudience is set to AzureADandPersonalMicrosoftAccount or PersonalMicrosoftAccount.

Since you've observed this working in other app registrations, the issue might be related to the app's certification status or other constraints imposed by Microsoft Teams Store integration. I suggest checking whether the app is in a state that restricts manifest updates. You could also try updating the property via the Microsoft Graph API instead of the portal.

Let me know if you need further assistance!

Regards,

Obinna
Georgii Bogdanov 20 Reputation points

2025-04-02T13:54:47.6533333+00:00

Looks like it worked via Azure CLI command, property is updated now.
Obinna Ejidike 740 Reputation points

2025-04-02T14:01:24.5566667+00:00

Hi Georgii,

Thanks for the update! Glad to hear that the property was successfully updated via Azure CLI. This suggests that the restriction was likely due to UI limitations in the Azure Portal.

Using the CLI or Microsoft Graph API can sometimes bypass constraints that exist in the portal for certain app configurations, especially when dealing with published apps or Teams-integrated registrations.

Appreciate you sharing the resolution—this could help others facing a similar issue!

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Obinna

Share via

Updating requestedAccessTokenVersion property in app registration manifest results in error

0 additional answers

Your answer