Programmatically get a list of registered add-in principals for a site collection

[MrTantum]

What type of issue is this?

Question

What SharePoint development model, framework, SDK or API is this about?

SharePoint Add-ins

Target SharePoint environment

SharePoint Online

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

No response

Issue description

Usecase:
How can we programmatically find all site collections where Apps have access to the content within the site collection and list these apps using any available API available for SharePoint (CSOM, REST, PowerShell, MS Graph)?

Apps that have access to the content within the site collection are shown at {SiteUrl}/_layouts/15/appprincipals.aspx. But there does not seem any API available to get this data.

Steps to reproduce

1. Register a new site collection by following “To register by using AppRegNew.aspx”-step on this page: https://docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/register-sharepoint-add-ins#to-register-by-using-appregnewaspx
2. Note the ClientID of the app.
3. Grant permission for the app by going to {SiteUrl}/_layouts/15/appinv.aspx and enter the ClientID of the app from step 2. in Textbox "App Id"
4. Click Lookup
5. For textbox "Permission Request XML" enter the following XML:

<AppPermissionRequests AllowAppOnlyPolicy="true">  
<AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" 
Right="FullControl" />
</AppPermissionRequests>

6. Click Create-Button
7. Go to {SiteUrl}/_layouts/15/appprincipals.aspx to show app access. The new app should be visible here.
   a. We need to get the results from this page programmatically. How can this be achieved? In best case a API endpoint would contain:

• App Name
• App ID
• List of permissions granted for the current site collection

Things tried so far

1. CSOM/JSOM AppCatalog.GetAppInstances: This method does not return any results for this usecase because it is only used for apps that have been installed in the site collection but not for apps that have only been granted permission for the site.
2. Get-PNPApp: This PNP PowerShell command does the same as AppCatalog.GetAppInstances and therefore does not help either.
3. Web Properties: I have checked all web properties of the site collection where I granted the app permissions but there is nothing that is related to Add-In permissions.
4. Check for hidden lists: I expected there might be some kind of hidden list in the site collection (e.g. similar to Sharing List) but I did not find anything.

Thank you for reporting this issue. We will be triaging your incoming issue as soon as possible.

[github-actions]

Thank you for taking the time to file an issue. We periodically archive older or inactive issues as part of our issue management process, which automatically closes them once they are archived.

If you’d like to understand more about why and how we handle archived (closed) issues, please see Our approach to closed issues.

We appreciate your contribution and if this is still an active issue with the latest SPFx versions, please do resubmit the details. We needed to perform a cleanup, so that we can start with a clean table with a new process. We apologize for the inconvenience this might cause.