ODM Power Platform - [Source tenant] Missing consent: 'PowerApps.Apps.Update' (4384408)

In the On Demand Migration console, the Test Power Platform Connection logs a missing consent for the source tenant:

[Source tenant] Missing consent: 'PowerApps.Apps.Update'

Expanding Additional Information for the message shows:

The following functionality will not work:
updating and modifying Power Platform (e.g., making apps solution-aware)

Figure 1

Missing consent message for the source tenant as reported in the On Demand Migration console

Symptoms

• The missing‑consent message is raised against the source tenant only; the target tenant may report no issue.
• Power Platform apps in the source tenant cannot be updated or modified by On Demand Migration, for example, apps cannot be made solution‑aware.
• Other Power Platform operations that only read source data continue to work, so the condition can go unnoticed until an update operation is attempted.
• Re‑running the readiness check or refreshing the tenant does not clear the message.

The permission is requested by the Quest Power Platform application registered under client ID 4078503c‑d803‑4056‑8ee8‑bf93f1b66fc6 against the Power Platform API (api.powerplatform.com).

The Quest Power Platform application has not been granted the PowerApps.Apps.Update scope in the source tenant. Consent in Microsoft Entra ID is recorded per scope and per tenant: the service principal in the source tenant carries the scopes that were accepted when consent was last granted, and any scope that was not included in that grant remains unconsented.

Because On Demand Migration validates each required scope individually, the missing scope is reported on its own rather than as a general consent failure. Every other operation continues to work, only the calls that require PowerApps.Apps.Update, namely updating and modifying Power Platform apps (such as making an app solution‑aware), are blocked.

Grant admin consent for the PowerApps.Apps.Update scope in the source tenant by opening the consent request below, then re‑run the readiness check.

Collect the directory (tenant) ID of the source tenant. It is shown on the Overview page of the Microsoft Entra admin center for that tenant, and also on the tenant entry in the On Demand Tenants list. The value is a GUID, for example 00000000‑0000‑0000‑0000‑000000000000.

On a workstation with a browser, run the following command in Windows PowerShell, replacing <TenantID> with the source tenant ID from Step One:

Start-Process "https://login.microsoftonline.com/<TenantID>/oauth2/v2.0/authorize?client_id=4078503c-d803-4056-8ee8-bf93f1b66fc6&prompt=consent&response_type=code&scope=https%3A%2f%2fapi.powerplatform.com%2fPowerApps.Apps.Update"

The command opens the Microsoft sign‑in and consent page in the default browser. The URL can also be pasted directly into a browser address bar if PowerShell is not available.

Sign in with an administrator of the source tenant who can grant admin consent, review the requested permission, and select Accept. The browser is then redirected; a redirect or “page cannot be displayed” result at this point is expected and does not indicate a failure — the consent is recorded when Accept is selected.

Figure 2

Microsoft Entra ID consent prompt shown after running the command, select Accept to approve the permission

Return to the On Demand Migration console and refresh the source tenant / re‑run the readiness check. The Missing consent: ‘PowerApps.Apps.Update’ message is no longer reported, and Power Platform update operations, such as making apps solution‑aware, can be performed against the source tenant.

If the message persists after granting consent, verify the following:

• The tenant ID used in the URL is the source tenant, not the target tenant.
• The account used to accept the prompt is an administrator of that same tenant and is able to grant admin consent on behalf of the organization.
• Admin consent is not blocked by a tenant policy or a consent‑request workflow; if it is, the request must be approved by a reviewer before the permission takes effect.
• The full URL was used, including the scope parameter, a truncated URL consents to a different set of permissions.
• The tenant page in On Demand Migration has been refreshed after consent so the current permission state is re‑read.