[BUG] - UseWebLogin dosen't work if your SSO account is a guest on in the tenant you're trying to access

[Tanddant]

Reporting an Issue or Missing Feature

I know we're not supposed to use the -UseWebLogin but in some scenarios it's the only option, currently working with a client who's conditional access prevents me from using -Interactive when not on their network.

Using -UseWebLogin worked fine for a while, now however since my primary (windows) account has become a guest, it continues to try and use that, but my guest account does not have access to the root site collection, so I end up stuck on this screen

Essentially stating that external sharing has been turned off for https://.sharepoint.com/_layouts/15/settings.aspx.

Expected behavior

I would've hoped to have an option to run the loginprompt in incognito/inprivate so I could somehow avoid using my windows credentials.

Actual behavior

I end up being stuck on a "That didn't work" error message due to -UseWebLogin attempting to access the root site collection, and no option to "switch account"

Steps to reproduce behavior

On a tenant that's not the same as your windows accounts tenant:

1. Create a random site collection
2. Invite your windows connected account as a guest to this site
3. Turn off external sharing on the root site collection
4. Try and run the following command
   Connect-PnPOnline "https://NonPrimaryTenant.sharepoint.com/sites/SiteThatYourGuestAccountIsInvitedTo/" -UseWebLogin
5. Seemingly that's all it takes

What is the version of the Cmdlet module you are running?

PnP.PowerShell 2.1.1

Which operating system/environment are you running PnP PowerShell on?

• Windows
• Linux
• MacOS
• Azure Cloud Shell
• Azure Functions
• Other : please specify

[gautamdsheth]

hi @Tanddant , @koskila fixed this issue. You will need to supply additional parameter -RelativeUrl for this.

It is now available in the latest nightly build. Do check it out, thanks !

As mentioned, you should ideally use the interactive way , the weblogin method is not so safe and doesn't work with Graph related cmdlets.

[Tanddant]

@gautamdsheth, I'll keep an eye out, I finally managed to convince that specific admin to grant me the delegated permissions 😊

Always aiming for interactive, but sometimes admins don't understand the difference between delegated and app permissions, and no amount of explanation will ever be able convince them that it's not dangerous

[koskila]

Happy to hear you got around it @Tanddant 😅

I have to also clarify that I changed Connect-PnPOnline to actually use the supplied site instead of root site, and -RelativeUrl should only be used when the _layouts/15/settings.aspx (default) is not accessible in the site Connect-PnPOnline is used against.