Skip to content

Grant-PnPAzureADAppSitePermission Access denied #9923

Description

@REMY31470

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

💥 SharePoint Framework

Developer environment

None

What browser(s) / client(s) have you tested

  • 💥 Internet Explorer
  • 💥 Microsoft Edge
  • 💥 Google Chrome
  • 💥 FireFox
  • 💥 Safari
  • mobile (iOS/iPadOS)
  • mobile (Android)
  • not applicable
  • other (enter in the "Additional environment details" area below)

Additional environment details

  • browser version
  • SPFx version
  • Node.js version
  • etc

Describe the bug / error

Hello,
On 9 September Microsoft deprecated the Connect-PnPOnline connection with simple user authentication.
They now recommend using an application.
Here are the steps indicated on the Internet :

  • Create 2 applications (App1 and App2) on our Tenant: OK

  • Open a PowerShell as the user who will run the scripts: OK

  • Create a certificate on the server: OK

$Certificate=New-SelfSignedCertificate –Subject MSGraph -CertStoreLocation Cert:\CurrentUser\My
Export-Certificate -Cert $Certificate -FilePath "C:\Temp\Certificate.cer"

  • In « registration of applications », add certification to Certificates can be used as secrets to prove your identity and to generate a Digital Footprint: OK

  • add the SharePoint rights of AllSites.FullControl to the App1 application: OK

  • add the SharePoint rights of Sites.Selected to the App2 application: OK

  • Connecting in PowerShell using App1 and its Digital Footprint: OK

Connect-PnPOnline "https://tenant.sharepoint.com/ " -ClientId "App1-ID" -Tenant "Tenant-ID" -Thumbprint "App1- Thumbprint"

  • Add SharePoint XXX site permissions to App2: HS ERROR

Grant-PnPAzureADAppSitePermission -AppId " App2-ID" -DisplayName "Test" -Permissions Read -Site "https://tenant.sharepoint.com/sites/XXX"
Grant-PnPAzureADAppSitePermission: {"error":{"code":"accessDenied","message":"Access denied","innerError":{"date":"2024-09-17T11:38:09","request-id":"…","client-request-id":"…"}}}

  • even a simple Get doesn't work : HS ERROR

Get-PnPAzureADAppSitePermission -site "https://blevraultgroup.sharepoint.com/sites/XXX"
Get-PnPAzureADAppSitePermission: Forbidden (403): Access denied

Thank you in advance for your help and feedback.
Remy

Steps to reproduce

it's all in the Describe

Expected behavior

it's all in the Describe

Metadata

Metadata

Assignees

Labels

Needs: Author FeedbackAwaiting response from the original poster of the issue. Marked as stale if no activity for 7 days.Needs: Triage 🔍Awaiting categorization and initial review.sharepoint-developer-supportsharepoint-developer-supporttype:bug-suspectedSuspected bug (not working as designed/expected). See “type:bug-confirmed” for confirmed bugs.

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions