[BUG] - Authentication about powershell HOT 5 CLOSED

We are indeed very early in the transitioning stage to the new version of PnP PowerShell. We plan to go GA at the end of the year and until that time documentation will lack more than usual.

Register-PnPManagementShellAccess adds an entry to the Azure AD Enterprise Applications. It's a basically a registration that allows authenticated users (e.g. users able to authenticate towards the AD) to use a specified OAuth2 clientid towards SharePoint Online and the Microsoft Graph. It's very similar to creating your own clientid/secret/certificate combination and adding that to the Azure AD, with the difference that we predefined a series of permission scopes and make the clientid available as a multi-tenant application.

The cmdlet indeed needs to be executed by someone with write access to the AD, in order to successfully process that entry. It could be that the entry ended up in a 'stale' state. If you navigate to the Azure AD, go to Enterprise Applications, locate "PnP Management Shell", you can reconsent the approval from there if needed. Maybe that solves your issue?

Keep in mind, that while you can use the cmdlet to register the application, actual access to SharePoint artifacts (sites, webs, etc.) are still restricted based on the SharePoint security model.

from powershell.

Just adding that -ClientId and -ClientSecret do work successfully so assume they will be fine for app-only in function app so please disregard that bit of the query above.

Thanks :)

from powershell.

Not sure if it helps but I get similar using PS7:

Connect-PnPOnline -Url $url -Credentials $cred
Get-PnPWeb
Get-PnPWeb: Access denied. You do not have permission to perform this action or access this resource.

Connect-PnPOnline seems to connect OK but then the error occurs when I try to do anything.

from powershell.

@erwinvanhunen - I am working on getting a global admin to re-consent as you suggested and will let you know the result. I have checked the Enterprise App and while it looks fine I cannot see any permissions for SharePoint:

Is this as expected?

My account has also been added to this Enterprise App as a User - is this actually necessary?

Also, Connect-PnPOnline using ClientID and ClientSecret is working fine. Does this suggest that the Enterprise App is working correctly or does that connection method not actually use the app?

Sorry for so many questions!

Dave

from powershell.

Re-consent seems to have resolved the issue. Based on this I will assume that using ClientID/ClientSecret does not actually use the Enterprise App - which makes sense as I guess it is then using its own app.

Thanks again for the great work 👍

Dave

from powershell.