App role missing on service principal although present on app registration; Application permissions disabled and admin consent fails

Summary

An app role defined on an app registration was never synchronized to the

corresponding service principal in the same tenant. As a result, the portal's

"Application permissions" option was disabled for that API, and admin consent

failed. Deleting and recreating the service principal resolved it.

Environment

• Tenant: (6ae31a63-05b8-4d44-93c5-4ad9e370efe0), possibly an External ID tenant
• Signed in as a guest account (outlook.com account) via the Entra admin center
• API app registration: Application (client) ID: c1cf156a-e076-4a98-9282-df0f849396d8 Created: 2026-09-29
• App role on the app registration: id 17e49161-1564-4f76-aa3e-e51aa8699779, value "DaemonAppRole", allowedMemberTypes ["Application"], isEnabled true
• App manifest has servicePrincipalLockConfiguration enabled (isEnabled: true, allProperties: true)

Steps to reproduce

1. Create an API app registration and add app role "DaemonAppRole" (allowed member types: Applications, enabled).
2. In a separate client app registration, go to API permissions > Add a permission > APIs my organization uses > [API app].
3. The "Application permissions" option is disabled. <<< This is the problem
4. Add the role manually to the client app's manifest (requiredResourceAccess, type "Role") and click "Grant admin consent".

Actual result

• "Application permissions" button disabled in the portal.
• Admin consent fails with: "Grant consent failed with error: Claim is invalid: 17e49161-1564-4f76-aa3e-e51aa8699779 does not exist on resource application c1cf156a-e076-4a98-9282-df0f849396d8. [vm1a55cLUjJqJY4EyESEpv]"

Expected result

The app role on the app registration appears on the service principal, so it

is offered as an application permission and consent succeeds.

Troubleshooting performed

• Verified the app manifest: the role is correct, enabled, and member type is Application.
• Verified the service principal exists in Enterprise applications and matches the app ID.
• Disabled and re-enabled the app role: no effect.
• Clicking "Managed application in local directory": no effect.

Resolution / workaround

Deleting the service principal (Enterprise applications > Properties >

Delete) and letting it be recreated fixed the problem. After that,

Application permissions was enabled and consent worked.

Impact

The app role could not be assigned until the service principal was

recreated. Nothing in the UI indicates the service principal is out of

sync, and re-saving the role does not trigger a resync.

Request

Please investigate why the service principal's appRoles were not updated

from the application object, and whether the guest-account, External ID

tenant type, or servicePrincipalLockConfiguration setting contributed.