MK Nepal Solutions

Error: "SharePoint refuses the app on … only"

The App ID works on the tenant but one site or one person's OneDrive refuses it: locked, on hold, archived or restricted. Other sites keep copying.

What it means

The app checked the tenant's root site and it works there, so the App ID, certificate and permissions are correct. Only this site (often one user's OneDrive) refuses it. The app stops trying that site for 10 minutes and carries on with the others.

Common causes

  • The OneDrive belongs to a user who was removed or blocked, and the OneDrive is in its retention period or locked (read-only or no access).
  • The site is under a litigation or retention hold, or is archived (Microsoft 365 Archive).
  • Restricted site access (restricted access control) is turned on for the site, or the site has its own access policy (for example block access from unmanaged devices set on the site).
  • The site's lock state was set by an administrator (Set-SPOSite -LockState NoAccess or ReadOnly).

How to check and fix it

  1. In the SharePoint admin center, find the site (for OneDrive: Active sites, filter by OneDrive). Check Lock state, holds and restricted access.
  2. Or with PowerShell:
Get-SPOSite -Identity https://contoso-my.sharepoint.com/personal/jane_contoso_com | Format-List LockState, ArchiveStatus, RestrictedAccessControl, ConditionalAccessPolicy
  1. Unlock (Set-SPOSite -Identity … -LockState Unlock) or ask the administrator to allow the app, then Run again with Copy if newer.
As an alternative for a locked OneDrive, an administrator can add a person as site collection administrator and migrate that OneDrive with a Microsoft account (MFA) connection.
Was this article helpful?

Updated 2026-10-26