Here's a concise solution for resolving the authorization issue between Dynamics 365 Finance & Operations (FinOps) and SharePoint when loading bank statements via Electronic Reporting after enabling the "Upgrade SharePoint user authentication" feature (introduced in FinOps version 10.0.42).
✅ Problem
After enabling "Upgrade SharePoint user authentication", FinOps Batch service could no longer access SharePoint, resulting in Unauthorized errors in LCS logs.
✅ Root Cause
The feature enforces updated authentication, requiring explicit permissions for the FinOps application to access SharePoint.
✅ Microsoft’s Recommendation (Less Secure)
Grant Sites.ReadWrite.All to the FinOps app:
powershell
# Not recommended: gives access to ALL SharePoint sites
$erpServicePrincipal = Get-MgServicePrincipal -Filter "AppId eq '00000015-0000-0000-c000-000000000000'"
$sharePointServicePrincipal = Get-MgServicePrincipal -Filter "AppId eq '00000003-0000-0ff1-ce00-000000000000'"
$spAppRole = $sharePointServicePrincipal.AppRoles | Where-Object {$_.Value -eq 'Sites.ReadWrite.All'}
New-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $erpServicePrincipal.Id -PrincipalId $erpServicePrincipal.Id -ResourceId $sharePointServicePrincipal.Id -AppRoleId $spAppRole.Id
✅ Recommended (Secure) Approach — Grant Sites.Selected on Specific Site
🔒 Grant site-specific Write access via Microsoft Graph:
powershell
# Install and import Microsoft Graph module
Install-Module Microsoft.Graph -Force
Import-Module Microsoft.Graph
# Authenticate with necessary permissions
Connect-MgGraph -Scopes "Sites.FullControl.All"
# Define target site collection
$targetSiteUrl = "https://graph.microsoft.com/v1.0/sites/mytenant.sharepoint.com:/sites/test"
# Get Site ID
$response = Invoke-MgGraphRequest -Method GET -Uri $targetSiteUrl
$siteId = $response.id
# Get Dynamics ERP Service Principal
$erpServicePrincipal = Get-MgServicePrincipal -Filter "AppId eq '00000015-0000-0000-c000-000000000000'"
# Prepare permission parameters
$params = @{
roles = @("write")
grantedToIdentities = @(@{
application = @{
id = $erpServicePrincipal.AppId
displayName = $erpServicePrincipal.DisplayName
}
})
}
# Grant permission
Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/v1.0/sites/$siteId/permissions" -Body ($params | ConvertTo-Json -Depth 3)
✅ Result
Bank files were successfully loaded in FinOps within minutes, and the access was limited to only the specified SharePoint site, ensuring better security compliance.
Let me know if you’d like this wrapped up into a shareable document or deployment script!
