Edit

Share via

Troubleshoot wrap feature issues in Power Apps

This guide provides solutions to common issues encountered when using the wrap feature in Microsoft Power Apps.

Issue 1: Wrap build fails

If your wrap build fails, try the following actions:

Verify image formats

All images in your wrap project must be in PNG format. Using other formats causes the build to fail. Use an image converter to convert images to .png.

Important

Renaming a file extension to .png doesn't convert the image to PNG format.

Check Azure key vault setup

Your key vault must contain:

  • For iOS: Two tags, one certificate, and one secret.
  • For Android: One tag and one certificate.

Issue 2: Wrap button is disabled

You can only wrap apps if you have edit permissions. Confirm you have the correct permissions for the app and try again.

Issue 3: Unable to save your wrap project or trigger a build

Update to the latest version of the wrap solution and try again.

Issue 4: Unable to install wrapped mobile app

Ensure your app is properly signed by configuring a key vault during the build process, or signing the app manually.

For more information, see:

In addition, verify your device meets the minimum requirements.

Issue 5: Can't sign in or see data in wrapped app

If you can't sign in or see data in your wrapped app, try the following actions:

Verify API permissions and access

  • Ensure all required API permissions are configured and admin permissions are granted.

    Screenshot that shows the API permissions for the app.

  • Ensure the Add-AdminAllowedThirdPartyApps script runs successfully.
    For more information, see Allow registered apps in your environment.

Check account type and redirect URIs

  • Verify the Microsoft Entra app type is set to Multitenant and the supported account type is Accounts in any organizational directory (Any Microsoft Entra ID tenant).

  • Configure proper redirect URIs for iOS and Android:

Issue 6: Azure key vault errors in wrap for Power Apps

You might encounter these error codes in the wrap wizard:

Error code Error message
1000118 Default subscription not found or missing access permissions.
1000119 Key vault doesn't exist or is missing access privileges.
1000120 No organization ID tags found on key vault. Ensure that the tag {Bundle ID}.{organization-id} is present and uses the correct case sensitivity.
1000121 Android keystore isn't valid. Ensure that the tag {Bundle ID}.{keystore} is present and uses the correct case sensitivity.
1000122 iOS certificate isn't valid. Missing Tag and/or Secret. Ensure that the tag {Bundle ID}.{cert} is present and uses the correct case sensitivity.
1000123 iOS profile isn't valid. Ensure that the tag {Bundle ID}.{profile} is present and uses the correct case sensitivity.
1000128 Missing access key required to access the Azure Blob Storage location. Ensure that the tag {Bundle ID}.{accessKey} is present and uses the correct case sensitivity.
1000130 Missing default value: The required environment variable for setting up Azure Key Vault in the wrap wizard isn't set.
1000131 No tags or missing access permission for the specified Azure Key Vault.
1000132 Missing environment variable 'PA_Wrap_KV_ResourceID' for the targeted environment.

Error code 1000118

Erroe message: Default subscription not found, or missing access permissions.

Resolution steps

  1. Ensure your Azure key vault is in the tenant's Default subscription.

  2. As a Microsoft Entra ID (formerly Azure AD) admin, add the service principal for the AppID "4e1f8dc5-5a42-45ce-a096-700fa485ba20" by running the following commands in PowerShell:

    Connect-AzureAD -TenantId <your tenant ID>
New-AzureADServicePrincipal -AppId 4e1f8dc5-5a42-45ce-a096-700fa485ba20 -DisplayName "Wrap KeyVault Access App"

  3. In the Azure portal, under Access Control (IAM), assign the Reader role to your service principal:

    1. Go to Access control (IAM), and then select Add role assignment.

      Screenshot that shows the Add role assignment option in the Access control (IAM) tab.

    2. Choose Reader under Job function roles and go to the Members tab.

      Screenshot that shows the Members tab on the top menu.

    3. Search for your app name.

      Screenshot that shows how to search for your app.

    4. Assign the Reader role.

      Screenshot that shows how to assign a Reader role to your app.

Error code 1000119

Error message: Key vault doesn't exist, or Key vault is missing access privileges.

Resolution steps

  1. Confirm your Azure key vault is in the tenant's Default subscription.

  2. While creating the key vault, select Vault access policy.

    Select the Vault Access policy option under the Access configuration tab.

  3. As a Microsoft Entra ID (formerly Azure AD) admin, add the service principal for the AppID "4e1f8dc5-5a42-45ce-a096-700fa485ba20" by running the following commands in PowerShell:

    Connect-AzureAD -TenantId <your tenant ID>
New-AzureADServicePrincipal -AppId 4e1f8dc5-5a42-45ce-a096-700fa485ba20 -DisplayName "Wrap KeyVault Access App"

  4. In the Azure portal, assign the Reader role as shown in the previous error code section.

  5. Add access policies to the key vault:

    Screenshot that shows how to add access policies for your Azure key vault.

    Screenshot that shows how to review and create the vault access policy.

Error code 1000120

Error message: No organization ID tags found on key vault. Ensure that the tag {Bundle ID}.{organization-id} is present and uses the correct case sensitivity.

Resolution steps

  1. In the Power Platform admin center, select your environment.

    Screenshot that shows the Environment tab in Power Platform admin center.

  2. Copy the Organization ID.

    Screenshot that shows the organization ID that you can find in your environment in Power Platform admin center.

  3. In your key vault, go to Tags and create a tag named organization-id with your organization ID as the value.

    Screenshot that shows how to add an organization ID to a tag in Azure portal.

Error code 1000121

Error message: Android keystore isn't valid. Ensure that the tag {Bundle ID}.{keystore} is present and uses the correct case sensitivity.

Resolution steps

  1. Import your Android Certificate.

    Screenshot that shows how to import an Android certificate.

    Screenshot that shows how to create an Android certificate.

  2. Add a Tag for your certificate:

    • Tag name: Use the same Bundle ID as your wrap project (for example, com.testApp.wrap).
    • Tag value: Use the certificate name you assigned when uploading (for example, AndroidCertificate).

    Screenshot that shows how to create a certificate tag.

Error code 1000122

Error message: iOS certificate isn't valid. Missing Tag and/or Secret. Ensure that the tag {Bundle ID}.{cert} is present and uses the correct case sensitivity.

Resolution steps

  1. Import your iOS Certificate.

    Screenshot that shows how to import an iOS certificate.

    Screenshot that shows how to create an iOS certificate.

  2. Add a Tag for your certificate:

    • Tag name: Use the Bundle ID from your wrap project.
    • Tag value: Use the certificate name you assigned when uploading (for example, iOSCertificate).

    Screenshot that shows how to create a certificate tag for iOS.

Error code 1000123

Error message: iOS profile isn't valid. Ensure that the tag {Bundle ID}.{profile} is present and uses the correct case sensitivity.

Resolution steps

  1. Import your Provisioning Profile as a Secret.

  2. Add a Tag for your provisioning profile:

    • Tag name: Use the Bundle ID from your wrap project.
    • Tag value: Use the name you gave the secret when uploading (for example, iOSProvisioningProfile).

    Screenshot that shows how to create a tag for iOS Provisioning Profile Secret.

Error code 1000128

Error message: Missing access key required to access the Azure Blob Storage location. Ensure that the tag {Bundle ID}.{accessKey} is present and uses the correct case sensitivity.

Resolution steps

Add your access key from the Azure Blob storage account to the Azure key vault.

For more information, see Step 2: Target platform.

Error code 1000130

Error message: Missing default value: The required environment variable for setting up Azure Key Vault in the wrap wizard isn't set.

Resolution steps

  1. Assign the resource ID of the Azure key vault you intend to use with your wrap application to the variable.

  2. Confirm that the specified resource ID includes all required tags associated with the Bundle ID defined in the wrap wizard.

For more information, see Step 2: Target platform.

Error code 1000131

Error message: No tags or missing access permission for the specified Azure Key Vault.

Resolution steps

  1. Assign the resource ID of the Azure key vault you intend to use with your wrap application to the variable.

  2. Confirm that the specified resource ID includes all required tags associated with the Bundle ID defined in the wrap wizard.

  3. Ensure you have permission to access your key vault:

    1. As a Microsoft Entra ID (formerly Azure AD) admin, add the service principal for the AppID "4e1f8dc5-5a42-45ce-a096-700fa485ba20" by running the following commands in PowerShell:

      Connect-AzureAD -TenantId <your tenant ID>
New-AzureADServicePrincipal -AppId 4e1f8dc5-5a42-45ce-a096-700fa485ba20 -DisplayName "Wrap KeyVault Access App"

    2. In the Azure portal, under Access Control (IAM), assign the Reader role to your service principal:

      1. Go to Access control (IAM), and then select Add role assignment.

        Screenshot that shows the Add role assignment option in the Access control (IAM) tab.

      2. Choose Reader under Job function roles and go to the Members tab.

        Screenshot that shows the Members tab on the top menu.

      3. Search for your app name.

        Screenshot that shows how to search for your app.

      4. Assign the Reader role.

        Screenshot that shows how to assign a Reader role to your app.

For more information, see Step 2: Target platform.

Error code 1000132

Error message: Missing environment variable 'PA_Wrap_KV_ResourceID' for the targeted environment.

Resolution steps

  1. Check whether the environment variable PA_Wrap_KV_ResourceID exists in the target environment. If it doesn't, create it.

  2. Ensure the name follows the correct naming convention without typos or formatting errors.

For more information, see Step 2: Target platform.

Issue 7: Fail to sign in to wrapped app

  1. Ensure the user has access to the app. For more information, see Share a canvas app with your organization.

  2. If the user has app access but still can't sign in, check the conditional Access policies in Microsoft Entra admin center.

  3. Use the correlation ID from the failed sign-in screen for further troubleshooting.

Issue 8: Error message: "Something went wrong. [5objp]"

This issue might occur due to a Signature Hash Key mismatch or a Redirect URI mismatch during the app authentication process.

Common root causes

Cause 1: Signature Hash Key mismatch

The APK is signed with a different key than the one registered in the Microsoft Entra ID application. This might occur if:

  • A different keystore is used during the build process.

  • The registered hash key is incorrectly generated or copied (for example, it includes extra spaces or invalid characters.)

Cause 2: Redirect URI mismatch

The redirect URI being used by the app doesn't match what's registered in the portal:

  • Redirect URIs are case-sensitive. Mismatches might occur if the Bundle ID or URI is entered with incorrect casing.

  • Special characters in the URI (such as %2F, %3D) must be properly encoded and match exactly what is registered in Microsoft Entra ID.

How to fix the issue

Verify the Signature Hash Key

  1. Generate the correct hash key from the keystore used to sign the app.

  2. In the Microsoft Entra admin center, go to App registrations and select your app.

  3. In the app's navigation pane, select Authentication.

  4. Under the Platform configurations section, locate the Android platform.

  5. Check that your app's Signature Hash Key is listed and matches the hash key generated from your keystore.

  6. If the hash key is missing or incorrect, add or update it as needed, and then save your changes.

Check the Redirect URI

  1. Install Android Studio and set up an emulator.

  2. Launch the emulator and drag the APK file onto it to install the app.

  3. Open the app in the emulator, attempt to sign in, and note the error message.

  4. On the error screen, locate the redirect URI being used.

  5. If the hash key in the URI contains encoded characters (for example, %2F), decode them (%2F becomes /) to get the Signature Hash Key.

  6. Copy the decoded Signature Hash Key.

  7. In the Microsoft Entra admin center, go to App registrations and select your app.

  8. Under Authentication, review the configured redirect URIs.

  9. If the redirect URI is missing, add it with the correct Bundle ID and Signature Hash Key, and then save your changes.

  10. Compare the existing redirect URI character-by-character (including case and encoding) with the one registered in Microsoft Entra ID.

  11. If manually entering the Bundle ID in the portal, double-check for case consistency.

To avoid this error in the future:

  • Always copy the Bundle ID and hash key directly from the project or build output.
  • Use logging or emulator logs to inspect the exact redirect URI at runtime.
  • Avoid manually typing or modifying hash keys or redirect URIs.
  • Use Android Studio to verify your app configuration.

Issue 9: Error message "Something went wrong [2002]" and error code 9n155

The error might occur when the app registration isn't configured to support multitenant accounts.

Common root causes

This error typically occurs when the app registration is created using the wrap wizard, which by default sets the app to single-tenant mode. If the user doesn't manually update this setting or accidentally selects single tenant during manual app registration, wrap app is unable to authenticate, resulting in error code 9n155.

Resolution

  1. In the Microsoft Entra admin center, go to App registrations and select your app.

  2. In the Essentials section, locate Supported account types. It should be set to Multiple organizations. If not, set it to Accounts in any organizational directory (Any Microsoft Entra directory - Multitenant).

  3. Save your changes.

Other issues

If your issue isn't covered here, or if the preceding steps don't resolve your problem, see Next steps to report your issue. Be prepared to provide detailed steps to reproduce the problem.

Collecting diagnostic information

For troubleshooting sign-in issues, you can collect session details:

  • For wrap wizard: On the sign-in screen, tap the gear icon in the upper-right corner and select Session Details.
  • For mobile devices: After opening the app, press and hold the screen, and then select Session Details.

Next steps

If your issue still persists, search for more support resources or contact Microsoft support.