I'm trying to use setVerifiedPublisher to set the MPNID on an application via Graph, but am receiving an "UnknownError" in response

Mark Middlemist 171

Hi All

I'm currently working to create Entra App Registration programmatically (in C# using the Graph SDK), which will need to show as having a verified publisher. Creating the application is obviously quite standard, and I've managed to update the publisher domain by manually creating a Http call in code (as this appears to be missing from the SDK).

I'm now trying to set the MPNID to our company's value, which I've triple checked as valid on the created applications via the portal after the code has failed. I've tried both with the SDK and the manual approach to user setVerifiedPublisher and am getting a 403 forbidden response.

I did wonder whether the issue was with the service principle values I was using to create the ClientSecretCredential so have tried using InteractiveBrowserCredential, logging in with the same account I use for the portal with the same response.

I've monitored the portal's communications to make sure the content and URL I was using were correct and I can't see any difference, in the main substance at least.

To confirm, the response I get is 403, Forbidden, and an example of the response content is:

{"error":{"code":"UnknownError","message":"","innerError":{"date":"2024-12-30T17:06:18","request-id":"3380389e-4209-41ae-89e9-ecf6159b8ead","client-request-id":"3380389e-4209-41ae-89e9-ecf6159b8ead"}}}

Simon Smith 21 Reputation points

2025-01-14T12:32:06.3566667+00:00

Hi Mark, I am also experiencing this issue and don't know how to resolve it. I'd love to know what HTTP call you've made to set the publisher domain as according to MS documentation it is not possible to do programatically and causing me much grief!

Mark Middlemist 171

Hi Simon

You're right, the SDK doesn't support it for some reason (I actually went as far as to pull down the github repo after I'd found the REST call to verify). My code to access it is below (the full file is attached).

I take it you're already familiar with the requirement for the Application ID to be present in the domain's /.well-known/microsoft-identity-association.json in order for this to return successfully?

Hope this helps

Mark

public async Task<(Boolean Success, String ErrorContent)> VerifiyPulisherDomain(Guid applicationObjectId, String publisherDomain)
{
    String MessageBody = $"{{\"publisherDomain\":\"{publisherDomain}\"}}";
    String TargetUrl = $"https://graph.microsoft.com/v1.0/applications/{applicationObjectId}/verifyPublisherDomain";
    HttpClient HttpHandler = await GetGraphClient();
    HttpRequestMessage Request = new HttpRequestMessage(HttpMethod.Post, TargetUrl) {
        Content = new StringContent(MessageBody)
    };
    Request.Content.Headers.ContentType = new MediaTypeWithQualityHeaderValue("application/json");
    HttpResponseMessage Response = await HttpHandler.SendAsync(Request);
    String ResponseContent = String.Empty;
    if ((Response.Content.Headers.ContentLength ?? 0) > 0)
    {
        ResponseContent = await Response.Content.ReadAsStringAsync();
    }
    return (Response.IsSuccessStatusCode, ResponseContent);
}

Simon Smith 21 Reputation points

2025-01-15T21:27:47.5366667+00:00

Hi Mark

Many thanks for this snippet - it is exactly what I needed. I can now set the publisher domain from my Powershell script which then enables me to tackle the setVerifiedPublisher aspect. Hopefully I can get everything lined up and get past the dreaded 403....

Simon
Mark Middlemist 171 Reputation points

2025-01-15T21:55:02.7366667+00:00

I've got a ticket on this with support now. If anything useful comes up I'll share
Simon Smith 21 Reputation points

2025-01-17T09:34:28.5566667+00:00

Appreciated, I am most definitely back at the 403 issue now, exactly the same as you get above.

Share via

I'm trying to use setVerifiedPublisher to set the MPNID on an application via Graph, but am receiving an "UnknownError" in response

Your answer