[BUG] New-PnPTeamsTeam does not work in app-only context

[peterwiens]

Reporting an Issue or Missing Feature

When connection with certificate it is not possible to create a new Teams team.

Expected behavior

The Team should be created as if I used -Interactive

Actual behavior

Error message: Insufficient privileges to complete the operation

Steps to reproduce behavior

Connect-PnPOnline -Url $siteUrl -ClientId $clientId -CertificatePath $cert -CertificatePassword $secureCertificatePassword -Tenant $tenant 
New-PnPTeamsTeam -DisplayName $teamTitle -MailNickName $teamAlias -Owners $teamOwners -Members $teamMembers -ResourceBehaviorOptions WelcomeEmailDisabled

What is the version of the Cmdlet module you are running?

2.1.1 PnP.PowerShell

Which operating system/environment are you running PnP PowerShell on?

• Windows
• Linux
• MacOS
• Azure Cloud Shell
• Azure Functions
• Other : please specify

[jackpoz]

Cannot reproduce the issue using 2.99.80 :

What permissions does your app registration have ?

[stukkendfc]

I have a similar problem right now. Permissions granted are Group.ReadWrite.All, both as Delegated and Application. Always getting "Insufficient privileges to complete the operation." error message.

[jackpoz]

if you append -ErrorAction:Stop as additional parameter to New-PnPTeamsTeam , then you can get the callstack where the error happens with Get-PnPException | Select-Object * .

Chances are you are missing a User.* permission required to fetch the needed information for Owners and Members.

If I assign only Group.ReadWrite.All , I get the same error:

The error happens at this line:

var user = requestHelper.Get<User>($"v1.0/{GetUserGraphUrlForUPN(owners[0])}?$select=Id");

which indeed needs User.* permissions.

If I add User.Read.All permission, then it works fine (but moves to the next missing permission with error "New-PnPTeamsTeam: Forbidden (403): Caller does not have the required permissions for accessing this API. AllowedPermissions: 'TeamMember.ReadWriteNonOwnerRole.All,TeamMember.ReadWrite.All'"

[jackpoz]

You can enable additional logs with Start-PnPTraceLog -Level Debug to verify what was the last Graph call before the 403 error was thrown.