Unable to upload .sppkg to tenant app catalog: Access denied.

[MartinM85]

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

💥 SharePoint Framework

Developer environment

Windows

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

• browser version
• SPFx SPFx 1.24.0-beta.5 preview
• Node.js 22
• etc

Describe the bug / error

I've built a package and I'm trying to upload the package to the tenant app catalog, but I'm receiving 403 Forbidden.

{
    "error": {
        "code": "-2147024891, System.UnauthorizedAccessException",
        "message": {
            "lang": "en-US",
            "value": "Access denied."
        }
    }
}

The error appears even when I try to upload sample package like
https://github.com/pnp/spfx-copilot-components/blob/main/samples/my-day/sharepoint/solution/my-day.sppkg

Steps to reproduce

1. Create SPFx Copilot App
2. Build .sppkg
3. Upload it to the tenant app catalog

Expected behavior

I can upload the .sppkg file or a response with more detailed error and clear explanation is returned.

[m365-agent-toolkit-assistant]

👋 Hi Martin Machacek (@MartinM85),

Thank you for reporting this issue! We want to let you know that:

⏱️ Our team will personally review your issue
🎯 You can expect a response within 1 business day

✨ This is an AI-generated initial response
🤖 AI-Generated Preliminary Analysis:

Classification: Not a bug — currently most consistent with missing App Catalog upload/deploy permissions; the same failure with a known sample makes a package defect unlikely.

• Microsoft’s Copilot App tutorial requires permission to upload and deploy packages to the tenant App Catalog.
• type:bug-suspected is a triage signal, not confirmation.
• A prior app-only upload regression was confirmed and mitigated, but it applies only if app-only authentication is being used.

What to do now:

1. Confirm the uploading identity is an App Catalog administrator/site collection administrator for the tenant App Catalog.
2. Verify you are uploading to Apps for SharePoint in the tenant App Catalog, not a site collection catalog.
3. If it still fails, provide the authentication method, App Catalog URL/type, timestamp, correlation/request ID, and confirmation that an administrator gets the same result.

Useful links:

• Copilot App deployment prerequisites
• SharePoint/sp-dev-docs#10955 — Could not upload SPFx package to some MS365 tenants

---

Note: This is an automated first response generated by AI. A human team member will review your issue and provide a more detailed response soon. We appreciate your patience!