[Bug] AADSTS65002 When Adding SharePoint Data Source via Power Apps CLI

[Vulkarin]

Summary

AADSTS65002 error occurs when using the Power Apps CLI (npx power-apps add-data-source) to connect to SharePoint Online in a GCC environment.

Steps to Reproduce

1. Clone the vite template
2. Run npm i
3. Run npx power-apps init --cloud gccmoderate -e <YOUR_ENV_ID>
4. Attempt to run npx power-apps add-data-source -a shared_sharepointonline ...

Authentication fails immediately with AADSTS65002.

Error Message

invalid_request: Error(s): 65002 - Timestamp: 2026-05-08 15:19:13Z - Description:
AADSTS65002: Consent between first party application '9cee029c-6210-4654-90bb-17e6e9d36617'
and first party resource 'd93420f9-abc8-46b7-b7fc-30ec1f007ee2' must be configured via
preauthorization - applications owned and operated by Microsoft must get approval from the
API owner before requesting tokens for that API.

Field	Value
Trace ID	0a35eebe-3be4-4f18-ad0e-8f6ef95a4b00
Correlation ID	b18df6d0-c3ce-42a9-ac2b-fd3f3289a88a
Timestamp	2026-05-08 15:19:13Z

Expected Behavior

The CLI successfully adds the SharePoint Online data source to the Power Apps Code App.

Actual Behavior

Authentication fails immediately. The command cannot complete, making it impossible to programmatically connect a Power Apps Code App to SharePoint via the CLI in a GCC environment.

Analysis

This appears to be a missing preauthorization between Microsoft's own first-party applications:

• CLI App: 9cee029c-6210-4654-90bb-17e6e9d36617
• Target Resource: d93420f9-abc8-46b7-b7fc-30ec1f007ee2

The error explicitly states this is a first-party-to-first-party consent issue that cannot be resolved by the tenant admin — it requires Microsoft to add the preauthorization on their end for GCC cloud environments.

[eschavez]

Thanks for the detailed repro and the correlation IDs — very helpful.

We're seeing the same pattern here as in #339 (AADSTS65002 when adding the SQL Server data source in GCC moderate). Both come down to the same first-party preauthorization gap:

• PAC CLI app: 9cee029c-6210-4654-90bb-17e6e9d36617
• Connector-runtime resource: d93420f9-abc8-46b7-b7fc-30ec1f007ee2

The preauthorization between these two is in place for commercial tenants, but hasn't been fully propagated to GCC sovereign endpoints — which means any connector that routes through the connector-runtime resource will fail with AADSTS65002 in GCC. SharePoint Online appears to hit that same path alongside SQL Server.

This is a service-side fix that needs to go through our AAD team; there's no CLI-side workaround we can offer in the meantime. We're tracking the broader preauthorization rollout to GCC as part of the work that came out of #339 and will update both threads when it's resolved.

If you're blocked and need it escalated on the AAD side, referencing correlation ID b18df6d0-c3ce-42a9-ac2b-fd3f3289a88a in a support ticket may help.