My app registrations briefly appear in the Azure portal, then I get a 401 and a message saying I don't have access. I created the registrations and am still listed as an owner. I have Application Developer, but I also can't create new registrations.
What should an admin check? Could Conditional Access be involved, and is the session ID useful for troubleshooting?
First check whether Application Developer is an active assignment or an eligible one that needs activation through Privileged Identity Management. Having temporary access to an individual application is not necessarily the same thing as activating a directory role.
Also confirm the account and tenant in the portal, then have an admin verify both the role assignment and ownership of the affected registrations. Those checks help separate a role activation problem from an ownership or directory visibility problem.
Have the admin check directory read permissions too. A Directory Readers assignment alongside Application Developer is one suggested fix for being unable to see registrations, even when you're an owner. I'd treat it as a permission to investigate, not assume it's required in every tenant.
Ask the admin whether the tenant setting that lets users register applications was changed. If it was disabled, that could explain why creation worked before and doesn't now. Application Administrator or Cloud Application Administrator are other roles to investigate for registration access, though an admin should check their scope and whether broader permissions are appropriate.
h84~busselect_307:
Application Developer is worth checking separately before adding a broader role, especially if the assignment needs activation.
A 401 by itself doesn't establish that Conditional Access is the cause. Give the admin the session ID, approximate time, account, tenant, and the full error details so they have something to correlate with available logs. They can check sign-in and Conditional Access results as well as recent permission or tenant setting changes.
The brief display of names isn't proof that the subsequent request has the permissions it needs. The useful clue is which request fails and what the logs say about it.
Answers are reviewed before publication.
5m+gingerjar_817:
The tenant and account are correct, and I'm still listed as an owner. I can request temporary access to individual registrations, but that doesn't let me create new ones.