[BUG] 401 Unauthorized error when executing Register-PnPHubSite command for a satellite geo site in a multi-geo environment

[yoinuma]

Reporting an Issue or Missing Feature

I get an error when I do Register-PnPHubSite with Satellite Geo.
The command is executed as follows.

The app specified in -ClientId is pre-registered in Azure AD, and the "Sites.FullControl.All" API permission is assigned to the app.

For the same satellite geo, command Get-PnPTenantSite succeeds.
For the central geo, the command Register-PnPHubSite succeeds.

Expected behavior

The Register-PnPHubSite command should succeed without error.

Actual behavior

The Register-PnPHubSite command fails with 401 Unauthorized.

Steps to reproduce behavior

1. Create a multi-geo tenant and create a satellite geo within it.
2. Create a communication site within the satellite tenant.
3. Create Azure AD application and assign "Sites.FullControl.All" right to the app
   https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal
4. Run the Connect-PnPOnline and Register-PnPHubSite commands with the same options as in the screenshot at the top.

What is the version of the Cmdlet module you are running?

1.5.0 and 1.6.0

Which operating system/environment are you running PnP PowerShell on?

• [〇] Windows
• Linux
• MacOS
• Azure Cloud Shell
• Azure Functions
• Other : please specify

[taisuke0710]

I could repro with the following CSOM code. CSOM is up to date.
I believe it's not PnP issue and opened a support ticket to Microsoft. Microsoft product group concluded it's by design for now because registerhub api doesn't support app token in satellite location.

var clientId = "<clientId>";
var tenantId = "<tenantId>";
var scope = new string[] { "<SPO>/.default" };
var adminCenterUrl = "";
var targetSite = "";

var certPath = @"<pfx path>"; // Update to your local path.
var cert = new X509Certificate2(certPath, "<cert path>");

var app = ConfidentialClientApplicationBuilder.Create(clientId)
	.WithCertificate(cert)
	.WithAuthority("https://login.microsoftonline.com/" + tenantId)
	.Build();

var token = app.AcquireTokenForClient(scope).ExecuteAsync().GetAwaiter().GetResult().AccessToken;
var context = new ClientContext(adminCenterUrl);
context.ExecutingWebRequest += (sender, e) =>
{
	e.WebRequestExecutor.RequestHeaders["Authorization"] = "Bearer " + token;
};

var tenant = new Tenant(context);
tenant.RegisterHubSite(targetSite);
tenant.Context.ExecuteQuery();

[gautamdsheth]

@yoinuma - Looks like it is not supported by CSOM itself. So unfortunately we can't do anything from our side.

Thanks @taisuke0710 for confirming this, much appreciated.

Will be closing this issue.