kawa
881f3a8bac
Logs showed the failure was a transient 403 on the tenant admin endpoint (loading CurrentUser on -admin.sharepoint.com returned E_ACCESSDENIED on a cold token), and that re-running the operation a few seconds later succeeded. The site-collection admin grant is also eventually consistent on Group/Teams sites, taking a few seconds to reach the content endpoint. Retry both stages with backoff (3s, 6s, 9s; 4 attempts) instead of failing on the first denial: - ElevateAsync retries the admin-endpoint grant on transient access-denied; a genuine lack of tenant-admin rights still surfaces after retries exhaust. - After a successful grant, the post-elevation operation retries on continued access-denied to absorb grant-propagation lag. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>