CreateGroupEx rejects Entra app-only tokens when creating group-connected sites

[nicolaor]

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

SharePoint REST API

Developer environment

Windows

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

Describe the bug / error

We would like to report a bug in SharePoint REST /_api/GroupSiteManager/CreateGroupEx. The endpoint creates a Microsoft 365 group-connected team site successfully with user context, but fails with an internal HTTP 403 when the same operation uses a valid Entra application token.

Although CreateGroupEx is not publicly documented, this was the solution recommended by Microsoft Support in a support ticket opened by one of our customers. It is the only SharePoint API we know of that allows us to specify independently:

• the group email alias / mailNickname;
• the SharePoint SiteAlias;
• the site language through SPSiteLanguage.

Our unattended provisioning service is used across hundreds of customer tenants. Most customers require sites in multiple languages, and their SharePoint URL naming rules are often different from their group email naming rules. User or interactive authentication is therefore not a reliable option for this scenario.

Expected behavior

CreateGroupEx should accept a valid certificate-based Entra application token with SharePoint Sites.FullControl.All, or Microsoft should provide an equivalent app-only API that supports SiteAlias and SPSiteLanguage independently from the group email alias.

Actual behavior

The application token successfully calls other SharePoint REST endpoints, and GroupSiteManager/CanUserCreateGroup returns true. However, CreateGroupEx accepts and parses the request and then fails during its internal provisioning operation:

{
  "error": {
    "code": "-1, System.Net.WebException",
    "message": "The remote server returned an error: (403) Forbidden."
  }
}

The outer REST response is HTTP 400 and the internal operation reports HTTP 403. No group or site is created.

We reproduced the failure with and without a form digest, with an explicit owner, with verbose and no-metadata OData payloads, and against both the tenant root and admin endpoints.

Correlation information

• Test date: 2026-08-11
• Approximate times: 08:48–08:52 UTC
• Tenant ID: 29aa64cf-e04e-4a9d-94e7-5fca415f8ed8
• SharePoint tenant: https://rnico.sharepoint.com
• Entra application ID: 0ae3ccaf-e3bc-476e-a99d-57f1e5bca0b3
• Token audience: 00000003-0000-0ff1-ce00-000000000000
• Token identity: idtyp=app, with no delegated scp
• SharePoint application role: Sites.FullControl.All
• SharePoint request ID: fa2230a2-d076-e000-c5af-86fc6acb3626
• SharePoint request ID for the corrected OData no-metadata request: 1b2330a2-402f-e000-6dfe-f1d6b033f377

We previously had a working app-only solution through Microsoft Graph using creationOptions such as SiteAlias:<value> and SPSiteLanguage:<LCID>. That functionality stopped working. We understand those Graph options were never documented, but there is now no reliable app-only alternative.

Could you please investigate why CreateGroupEx rejects the application identity despite the valid permissions and successful preflight checks? If app-only is intentionally unsupported for this endpoint, please advise which supported API should be used to create a group-connected site with an independent URL and language in an unattended application context.

Thank you for your help.

Steps to reproduce

1. Configure an Entra application with the SharePoint application permission Sites.FullControl.All, grant tenant-wide admin consent, and authenticate with a certificate using the OAuth 2.0 client-credentials flow.

2. Request an access token for:

   https://contoso.sharepoint.com/.default
   

   The resulting token has idtyp=app, contains the Sites.FullControl.All role, and has no delegated scp claim.

3. Verify that the token can access SharePoint REST:

   GET https://contoso.sharepoint.com/_api/web
   Authorization: Bearer <app-only-token>
   Accept: application/json;odata=verbose

   This returns HTTP 200.

4. Verify the group-creation preflight:

   GET https://contoso.sharepoint.com/_api/GroupSiteManager/CanUserCreateGroup
   Authorization: Bearer <app-only-token>
   Accept: application/json;odata=verbose

   This returns HTTP 200 with CanUserCreateGroup=true.

5. Resolve a valid group owner in the same tenant, then call CreateGroupEx:

   POST https://contoso.sharepoint.com/_api/GroupSiteManager/CreateGroupEx
   Authorization: Bearer <app-only-token>
   Accept: application/json;odata=verbose
   Content-Type: application/json;odata=verbose
   X-RequestDigest: <valid-form-digest>

   {
     "displayName": "Finance transformation program",
     "alias": "finance-ops",
     "isPublic": false,
     "optionalParams": {
       "Description": "Created by an unattended provisioning application",
       "Owners": {
         "results": [
           "owner@contoso.com"
         ]
       },
       "CreationOptions": {
         "results": [
           "SiteAlias:finance-transformation-program",
           "SPSiteLanguage:1031"
         ]
       },
       "Classification": ""
     }
   }

6. Observe that SharePoint parses the request but returns HTTP 400 with an inner HTTP 403. No Microsoft 365 group or SharePoint site is created.

The same result occurs without X-RequestDigest, with OData no-metadata syntax, without an owner, and when the request is sent to the SharePoint admin endpoint.

[Ashlesha-MSFT]

Hello Rene Nicolao (@nicolaor)
Thank you for bringing this issue to our attention. We will look into it and get back to you shortly.

[NicolasMCAG]

Facing the same issue over here as well.

[ximoran-bot]

Same here!

[Ashlesha-MSFT]

We were able to reproduce the reported issue. CreateGroupEx returned HTTP 400 with an internal HTTP 403 when using a valid Entra app-only token with Sites.FullControl.All, while the prerequisite SharePoint calls succeeded.

We will raise a bug with the relevant product team for further investigation.