Sites.Selected permission stopped working this morning - sharepoint

Question

We have a multitenant application that heavily relies on the Graph API. We access both mailboxes through Messages API and Sharepoint sites through Files API. Most clients use a very permissive access model to get more features available in our application. A few has strict demands on access and for those we are only allowed to access a specific sharepoint site. For this site we've registered another AppId to use Sites.Select permission where the clients Global Admin allow access to our application using PowerShell
This has worked fine until this morning, where all requests to the Files API are returning "403 Forbidden" and the C# SDK is returning "Access denied".
I've requested the clients to execute PowerShell command to verify if we still has access to their Sharepoint site:
Get-PnPAzureADAppSitePermission -AppId 'xxxxxxxxxxxx'
but they all get the same error message:
Get-PnPAzureADAppSitePermission: Operation Failed
The Pnp.PowerShell cmdlet used is 1.10
Anyone know why this happened to MS Graph or if the PS error is related to the Graph error?
Did Microsoft change something?

Answer 1

This has been acknowledged by MS as an unexpected service issue and can be tracked as SP381039
Title: Users may see 'Access Denied' errors when using Graph APIs for SharePoint Online
User Impact: Users may see 'Access Denied' errors when using Graph APIs for SharePoint Online.
Current status: We've identified that components of the authentication feature are unexpectedly not present in some users' environments thus resulting in the Graph API access requests to fail. We're redeploying the affected feature within impacted environments to remediate impact. In parallel, we're investigating recent feature changes to identity why the components are unexpectedly not present.
Next update by: Tuesday, May 17, 2022, at 5:00 PM UTC
Latest update from MS, received 17 May 16:45:
Current status: We've confirmed that a recent feature deployment misconfiguration has prevented components associated with the authentication feature from being available in a group of customer environments, which is producing 'Access Denied' errors when using Graph APIs for SharePoint Online. We've confirmed that our redeployment of the authentication feature to some impacted environments has resolved the impact. We're now redeploying the feature to all affected remaining environments, which is expected to remediate impact.
Scope of impact: This issue may potentially affect any of your users attempting to utilize Graph APIs for SharePoint Online.
Root cause: A recent feature deployment misconfiguration has prevented an authentication feature from being available in a group of customer environments, resulting in impact.
Next update by: Tuesday, May 17, 2022, at 9:30 PM UTC

Answer 2

Exactly the same issue Tuesday AM New Zealand time. Using C# code / Postman and PowerShell directly.
I've logged a ticket with Microsoft as my guess (no evenidence) is it is a code regression on PNP. I'll update here if I hear anything.
We have 2 apps (test and prod), both began failing Tuesday morning with 403 / access denied messages.
When I tried to check permissions and reset permissions using
get-PnPAzureADAppSitePermission
or
grant-PnPAzureADAppSitePermission
Powershell says : "Operation not supported"
Full text
Grant-PnPAzureADAppSitePermission : {"error":{"code":"notSupported","message":"Operation not supported","innerError":{"
date":"2022-05-16T23:39:16","request-id":"xxxx-azureappid-yyyy","client-request-id":"xxxx-azureappid-yyyy"}}}
At line:8 char:1
Grant-PnPAzureADAppSitePermission -AppId $appId -DisplayName 'TenantName...
+ CategoryInfo : NotSpecified: (:) [Grant-PnPAzureADAppSitePermission], HttpRequestException
+ FullyQualifiedErrorId : System.Net.Http.HttpRequestException,PnP.PowerShell.Commands.Apps.GrantPnPAzureADAppSite
Permission

Answer 3

This morning when I tested this, everything is back to the way it was on Friday New Zealand time.
I've heard from Microsoft via the ticket I logged, that the "PG team had reinstated an update from the backend". It didn't work last night, but this morning we're back up and running.
I hope your tenancies come back too. If not log a Microsoft ticket if you can. I do this via the https://admin.microsoft.com/Adminportal/Home?source=applauncher#/support/requests page using the "New service request" menu item. We have this feature due to our contract with Microsoft.