Release 3.4.0

Added

• Added -List to Get-PnPStoredCredential to enumerate the names of the stored PnP credentials without requiring a credential name. #5445
• Added Test-PnPSiteTemplate to validate the schema, internal structure and packaged resources of a PnP site template without applying it. #5444
• Added -EnableSensitivityLabelForOneNote and -EnableSensitivityLabelForVideoFiles parameters to Set-PnPTenant. #5442
• Added Test-PnPConnectionPermission which compares the current connection's access token claims with the permission metadata of a PnP PowerShell cmdlet. #5428
• Added ApiPermissionsDependOnResource attribute for cmdlets of which the required permissions follow from the resource they are pointed at or from how they are invoked, and applied it to Get-PnPGraphSubscription, New-PnPGraphSubscription, Set-PnPGraphSubscription, Remove-PnPGraphSubscription, Invoke-PnPGraphMethod, New-PnPSite, Set-PnPSiteClassification and Sync-PnPSharePointUserProfilesFromAzureActiveDirectory. #5427
• Added ApiPermissionsNotRequired attribute for cmdlets which need no permissions on the application registration PnP PowerShell connects with, and applied it to Get-PnPConnection, Get-PnPContext, Set-PnPContext, Get-PnPPowerShellTelemetryEnabled, Enable-PnPPowerShellTelemetry, Disable-PnPPowerShellTelemetry, Register-PnPEntraIDApp and Register-PnPEntraIDAppForInteractiveLogin. #5427
• Added Get-PnPCommandPermission cmdlet which returns the delegated and application API permissions and the minimum SharePoint role required to run a cmdlet. #5427
• Added Add-PnPTenantSearchCrawledProperty cmdlet which allows creation of a tenant level crawled property for SharePoint Online search. #5373
• Added GitLab CI/CD support to Connect-PnPOnline -FederatedIdentity. #5395
• Added PreferredDataLocation support to Set-PnPMicrosoft365Group and documented it for Get-PnPMicrosoft365Group and New-PnPMicrosoft365Group. #5402
• Added Standard and EDU_Staff template support to New-PnPTeamsTeam and provision Teams templates through Microsoft Graph team templates. Note that EDU_Class and EDU_PLC are now also provisioned through Microsoft Graph team templates (POST /teams) instead of the previous Microsoft 365 Group creation and teamify flow. #999
• Added -ExchangeApplicationPermissions, -ExchangeDelegatePermissions, -PowerBIApplicationPermissions, -PowerBIDelegatePermissions, -DataverseDelegatePermissions, -PowerAppsDelegatePermissions, -AzureServiceManagementDelegatePermissions and -ResourcePermissions to Register-PnPEntraIDApp, the last one to request permissions on any other API. #5424
• Refreshed the permissions shipping with the module, taking Microsoft Graph from 223 application and 294 delegated permissions to 705 and 795, and SharePoint from 9 and 18 to 20 and 29. #5424
• Added -IncludeExtensionAttributes to Get-PnPMicrosoft365Group, which populates the OnPremisesExtensionAttributes property with the extension attributes 1-15 of a group. Microsoft Graph only populates these for groups that are synchronized from an on-premises Active Directory, not for cloud only groups. #5425

Changed

• Changed Connect-PnPOnline -FederatedIdentity to acquire its access token through MSAL so that it is cached and renewed instead of being minted on every call, which fixes SharePoint failing with an HTTP 401 after roughly an hour because the CSOM requests kept using the token acquired at connect time. -AzureEnvironment is now also honoured for the Entra ID login endpoint, the Microsoft Graph endpoint and the token exchange audience, so that this connection method works outside of the commercial cloud. #5446
• Changed Set-PnPSiteSensitivityLabel to resolve a label name through the current Microsoft Graph sensitivity labels API instead of the deprecated information protection labels API that Microsoft has announced will stop returning data. #5440
• Changed Get-PnPTenantRetentionLabel to call the generally available v1.0 Microsoft Graph retention label endpoint instead of the beta one. #5440
• Changed Set-PnPListItem, Add-PnPListItem, Add-PnPFile and Copy-PnPFileMetadata to retrieve only the fields named in -Values instead of the full field collection of the list, when not passing -Batch, which retrieves the field collection once for the whole batch. #5437
• Changed Get-PnPListItem to report what can be done about a query SharePoint refuses for projecting more than 12 lookup, person or managed metadata columns through -Fields or -Query. #5437
• Changed Get-PnPSiteTemplate, Get-PnPTenantTemplate, Invoke-PnPTenantTemplate and Export-PnPPage to fail on a -Configuration which cannot be read, holds a null, or names no recognized handler, and to warn about a property or handler it does not recognize, instead of ignoring these and processing everything. #5434
• Changed Register-PnPEntraIDApp and Register-PnPEntraIDAppForInteractiveLogin to register exactly the requested permissions. An invocation whose permissions were all silently dropped, such as -Scopes holding only delegated permissions, previously fell back to the default permission set, so the resulting app can differ from before for the same command line. #5424
• Changed Register-PnPEntraIDApp and Register-PnPEntraIDAppForInteractiveLogin to no longer accept permissions that their resource has retired or disabled, as those can never be granted. This covers the TeamsApp.*, Approval.*, ApprovalRequest.*, SensitiveInfoType.*, Place.Read, Place.Read.Shared, Place.ReadWrite, ChannelMessage.Delete, DataLossPreventionPolicy.Evaluate and AgentCard.* Microsoft Graph permissions and the ThreatIntelligence.Read and ActivityReports.Read Office 365 Management APIs permissions. #5424
• Changed Export-PnPFlow -AsZipPackage and Export-PnPPowerApp to ask for confirmation before overwriting an existing file when -OutPath is omitted, as they already did when -OutPath is specified. Unattended scripts that rely on the previous silent overwrite need to specify -Force. #5421

Fixed

• Fixed Get-Help <cmdlet> -Online opening the PnP PowerShell landing page instead of the documentation page of the cmdlet, for every cmdlet in the module. #5443
• Fixed Get-PnPTenantRetentionLabel returning nothing at all when any retention label in the tenant uses a value the module did not know about, such as the relabel action after the retention period. #5440
• Fixed Request-PnPPersonalSite polling the operation when -NoWait was specified and returning immediately when it was not, which is the opposite of what the parameter describes and of what the other cmdlets taking -NoWait do. #4329
• Fixed Set-PnPListItem, Add-PnPListItem, Add-PnPFile and Copy-PnPFileMetadata failing with The specified user could not be found. when a person column in -Values is given a user id as a number instead of as a string, in both the direct and the -Batch code path. #5437
• Fixed Set-PnPListItem, Add-PnPListItem, Add-PnPFile and Copy-PnPFileMetadata failing with Column 'x' does not exist. when a column in -Values is referenced by its display name instead of its internal name, which previously only worked for managed metadata columns. #5437
• Fixed Get-PnPFolderInFolder, Get-PnPEventReceiver, Get-PnPGroup, Get-PnPRecycleBinItem and Set-PnPTerm accepting -Includes and then discarding it, so properties which are not returned by default, such as ParentFolder on a folder, came back as an empty object instead of being populated. #5436
• Fixed Get-PnPSiteTemplate, Get-PnPTenantTemplate, Invoke-PnPTenantTemplate and Export-PnPPage throwing a NullReferenceException when -Configuration could not be read or was $null. #5434
• Fixed Disconnect-PnPOnline never removing the private key container which loading a certificate leaves behind, so every certificate based connect permanently added a private key file to the profile of the user. Certificates are loaded with X509KeyStorageFlags.UserKeySet, which places the key container under %APPDATA%\Microsoft\Crypto, while only the machine wide %ProgramData%\Microsoft\Crypto\RSA\MachineKeys was looked at, so the removal silently found nothing to do. Both locations are now checked, Connect-PnPOnline -CertificateBase64Encoded takes part in the cleanup as -CertificatePath already did, and a removal which does not succeed is written to the debug log rather than being swallowed. #5433
• Fixed New-PnPAzureCertificate -OutPfx and Register-PnPEntraIDApp -OutPath writing the PFX holding the private key using the default permissions of the process on Linux and macOS, which the usual umask leaves readable by every local account. The file is now created readable and writable by its owner only. The accompanying CER file holds no private key and keeps the default permissions. #5433
• Fixed Connect-PnPOnline -CertificatePath keeping the certificate file open for as long as the PowerShell session lived, which prevented the file from being moved, replaced or deleted and leaked a file handle on every connect. The same read could also return fewer bytes than the file holds and have the resulting truncated certificate reported as being corrupt or password protected. #5433
• Fixed Get-PnPTenantDeletedSite failing to fetch the additional details of a site whose url contains an ampersand, as the url was placed into the CAML query without being escaped. #5433
• Fixed Get-PnPListItemAttachment combining the file name returned by the server with -Path without reducing it to its file name part first, which meant a rooted value would have silently replaced the path that was asked for. #5433
• Fixed delegated and application permission metadata and documentation for Add-PnPPlannerBucket, Add-PnPPlannerRoster, Add-PnPPlannerRosterMember, Add-PnPPlannerTask, Get-PnPPlannerBucket, Get-PnPPlannerPlan, Get-PnPPlannerRosterMember, Get-PnPPlannerRosterPlan, Get-PnPPlannerTask, New-PnPPlannerPlan, Remove-PnPPlannerBucket, Remove-PnPPlannerPlan, Remove-PnPPlannerRoster, Remove-PnPPlannerRosterMember, Remove-PnPPlannerTask, Set-PnPPlannerBucket, Set-PnPPlannerPlan, and Set-PnPPlannerTask. #5432
• Fixed delegated and application permission metadata and documentation for Add-PnPTodoTaskFileAttachment, Get-PnPTodoList, Get-PnPTodoTask, Get-PnPTodoTaskChecklistItem, Get-PnPTodoTaskFileAttachment, Get-PnPTodoTaskLinkedResource, New-PnPTodoList, New-PnPTodoTask, New-PnPTodoTaskChecklistItem, New-PnPTodoTaskLinkedResource, Remove-PnPTodoList, Remove-PnPTodoTask, Remove-PnPTodoTaskChecklistItem, Remove-PnPTodoTaskFileAttachment, Remove-PnPTodoTaskLinkedResource, Update-PnPTodoList, Update-PnPTodoTask, and Update-PnPTodoTaskChecklistItem. #5432
• Changed Microsoft To Do cmdlets to target the user supplied through -User directly, avoiding an additional Microsoft Graph user lookup and correctly encoding guest user principal names. Invalid user identifiers now surface the Microsoft Graph error returned by the To Do endpoint instead of being silently ignored. #5432
• Fixed the Microsoft To Do cmdlets only requiring -User on connections made with Connect-PnPOnline -ClientId -Tenant -CertificatePath and its siblings. A managed identity, a workload identity, a federated identity and an application token passed to -AccessToken equally yield an application token, for which Microsoft Graph does not resolve /me, yet those fell through to /me and failed with a Microsoft Graph error rather than reporting that -User is required. The token type now decides instead of the connection method, read from the idtyp claim and, where a token does not carry that optional claim, from whether it carries delegated scopes or app roles. #5432
• Fixed Microsoft Graph permission metadata and documentation for Get-PnPTeamsTag, Remove-PnPTeamsTag, Set-PnPTeamsTag, Get-PnPTeamsChannelMessageReply, Get-PnPTeamsApp, Update-PnPTeamsApp, Get-PnPUserProfilePhoto, and Set-PnPCopilotAdminLimitedMode. #5432
• Fixed delegated permission metadata and documentation for Get-PnPPowerPlatformCustomConnector, Get-PnPPowerApp, Export-PnPPowerApp, and Set-PnPPowerAppByPassConsent. These cmdlets are now also marked as not being available under application permissions, as the delegated user_impersonation scope they need cannot be granted to an application. They were previously reported as undetermined rather than unsupported by Test-PnPConnectionPermission. #5432
• Fixed Get-PnPTodoTaskChecklistItem, Get-PnPTodoTaskFileAttachment, Get-PnPTodoTaskLinkedResource and Update-PnPTodoTask being reported as not available under application permissions while Microsoft Graph does support them app-only for a user supplied through -User. They now declare Tasks.Read.All respectively Tasks.ReadWrite.All. #5432
• Fixed the Microsoft Planner Roster cmdlets Add-PnPPlannerRoster, Add-PnPPlannerRosterMember, Get-PnPPlannerRosterMember, Get-PnPPlannerRosterPlan, Remove-PnPPlannerRoster and Remove-PnPPlannerRosterMember declaring the delegated scopes Tasks.Read and Tasks.ReadWrite as application permissions, which no application can be granted. They now declare those as delegated permissions and additionally declare Tasks.Read.All and Tasks.ReadWrite.All, which the Microsoft Graph roster APIs do support as application permissions. Get-PnPPlannerRosterMember also asked for Tasks.ReadWrite where Tasks.Read suffices. #5432
• Changed Get-PnPUserProfilePhoto to address the user through the identifier provided to -Identity rather than through the id looked up from it, so a connection holding only ProfilePhoto.Read.All can now download a photo. The user is still looked up to keep naming the file after the display name of the user and to keep reporting an unknown user as such, but failing to look it up no longer stops the photo from being downloaded. When the display name cannot be read, the file is named after the identifier that was provided instead. #5432
• Fixed the Microsoft Planner cmdlets which accept -Group failing to look up a group whose mail nickname or display name contains a single quote, such as O'Brien Team, as the quote closed the OData string literal in the filter. The value is now escaped and url encoded the same way the Microsoft Teams cmdlets already did. #5432
• Fixed Update-PnPTeamsApp calling the undocumented PUT /appCatalogs/teamsApps/{id} instead of the POST /appCatalogs/teamsApps/{id}/appDefinitions which Microsoft Learn documents for this operation. The permissions the cmdlet asks for, AppCatalog.Submit in particular, are the ones documented for that POST, so the permission check could pass while the service denied the call. Both answer 204 No Content, so the cmdlet behaves the same. #5432
• Fixed Get-PnPUserProfilePhoto failing with Value cannot be null. (Parameter 'path2') instead of a meaningful message when -Filename was omitted for a user without a profile photo, as Microsoft Graph answers with a placeholder image of a type no file name can be derived from. #5432
• Fixed Get-PnPUser -WithRightsAssigned timing out or exhausting its retries on sites with large user information lists. The cmdlet now retrieves only directly assigned principals and members of SharePoint groups that have role assignments, instead of loading every site user and every site group member before filtering. #3162 #5431
• Fixed Add-PnPStoredCredential, Get-PnPStoredCredential and Remove-PnPStoredCredential not working on Linux when Microsoft.PowerShell.SecretManagement is not configured. Storing a credential reported success while writing nothing, and retrieving or removing one always came back empty, which also meant Connect-PnPOnline never resolved a stored credential on Linux. Credentials are now written to and read from the Linux Secret Service, and the username is stored alongside the password so a complete PSCredential is returned rather than the password on its own. Credentials are kept under their own keyring schema, separate from the one holding managed application ids. The same cmdlets were also silently doing nothing when Microsoft.PowerShell.SecretManagement is installed without a default vault being registered, on every platform, and now fall back to the credential store of the operating system in that situation. #5429
• Fixed the access token permission validation reporting a required permission as missing when the token holds a scope which covers it, such as a token with Sites.FullControl.All being reported as lacking Sites.Read.All. The permission metadata states the least privileged scope which suffices, so a more privileged scope now satisfies it. This affects the validation message written to the trace log by every cmdlet as well as Test-PnPConnectionPermission. #5428
• Fixed the documented permissions of Get-PnPGraphSubscription, which listed Subscription.Read.All as required. That permission is only needed to also return subscriptions created by other applications; reading back a subscription created by the current application requires the same permissions on the subscribed resource that were needed to create it. Also documented the resource dependent permissions of New-PnPGraphSubscription, Set-PnPGraphSubscription, Remove-PnPGraphSubscription and Invoke-PnPGraphMethod, and corrected Set-PnPGraphSubscription linking to the delete instead of the update API documentation. #5427
• Fixed the documented Microsoft Graph permission of Sync-PnPSharePointUserProfilesFromAzureActiveDirectory, which listed User.Read. Listing all users from Entra ID requires User.Read.All, and Microsoft Graph is only called when -Users is not provided. Its SharePoint permissions are now declared as metadata as well. #5427
• Fixed requested permissions not being applied by Register-PnPEntraIDApp and Register-PnPEntraIDAppForInteractiveLogin: -Scopes silently dropped every delegated permission, such as SPO.AllSites.FullControl, and -O365ManagementApplicationPermissions and -O365ManagementDelegatePermissions were never applied. A permission that cannot be resolved is now reported as an error, as is combining -Scopes with the per resource parameters. #5424
• Fixed incorrect ids for the Microsoft Graph Sites.Selected and Contacts-OnPremisesSyncBehavior.ReadWrite.All permissions and the SharePoint EnterpriseResource.Read permission. #5424
• Fixed Register-PnPEntraIDApp and Register-PnPEntraIDAppForInteractiveLogin running the consent flow against SharePoint for apps that request no SharePoint and no Microsoft Graph permissions. Such an app now reports that admin consent has to be granted through the Entra ID portal. #5424
• Fixed Get-PnPEntraIDAppPermission not reporting the Office 365 Management APIs permissions of an app registration. #5424
• Fixed the permissions shipping with the module being parsed once per cmdlet invocation, per dynamic parameter and per application reported on by Get-PnPEntraIDAppPermission. #5424
• Fixed required Microsoft Graph permission metadata for Send-PnPMail, Set-PnPList, Get-PnPWebAlert, Set-PnPSiteSensitivityLabel, Remove-PnPSiteSensitivityLabel, and Get-PnPAvailableSensitivityLabel. #5423
• Fixed required API permission metadata for Get-PnPPowerPlatformEnvironment, Get-PnPPowerPlatformSolution, Get-PnPPowerPlatformCustomConnector, Get-PnPPowerApp, Export-PnPPowerApp, Get-PnPPowerAppPermission, Remove-PnPPowerAppPermission, Set-PnPPowerAppByPassConsent, Add-PnPFlowOwner, Disable-PnPFlow, Enable-PnPFlow, Get-PnPFlowOwner, Get-PnPFlowRun, Remove-PnPFlow, Remove-PnPFlowOwner, Restart-PnPFlowRun, Restore-PnPFlow, and Stop-PnPFlowRun, including sovereign-cloud Dataverse audience recognition. #5422
• Fixed an issue with Add-PnPListItem and Set-PnPListItem cmdlets when trying to set taxonomy fields by passing in a GUID or term instance using a Batch. #5174
• Fixed issue with Azure functions not working properly when we also have other modules like Az which rely on .NET 10. #5393
• Fixed multi-geo compatibility issues with Get-PnPGeoAdministrator response handling, Set-PnPMultiGeoExperience confirmation prompts, and unsupported-version errors for Set-PnPMultiGeoCompanyAllowedDataLocation. #5401
• Fixed Power Apps cmdlets to use cloud-specific Power Apps service audiences and endpoints for government clouds. #5404
• Fixed Export-PnPPowerApp, Get-PnPPowerPlatformCustomConnector, Export-PnPFlow -AsZipPackage, and Import-PnPFlow to use the Power Apps service audience when calling Power Apps and Business Applications endpoints in sovereign clouds. #5408
• Fixed Export-PnPFlow -AsZipPackage silently doing nothing when the export failed. Failures are now reported on the PowerShell error stream and incomplete or unsuccessful package responses are rejected instead of resulting in an empty or invalid file. #1340
• Fixed Export-PnPPowerApp silently doing nothing when the export failed, and no longer polling forever when the service reports a failed export. The cmdlet now waits up to 30 minutes for the package to be prepared, following the polling interval requested by the service. #1340
• Fixed Import-PnPFlow ignoring its documented default polling behavior when -RetryCount and -Delay were omitted, which made the import fail with a missing property error. Both parameters now validate their range and a run that never becomes ready reports why. #5421
• Fixed Set-PnPPlannerPlan failing to update a plan that was modified by someone else while the update was in flight, and returning nothing instead of an error when the update could not be applied. #5421
• Fixed Get-PnPUserProfilePhoto and other Microsoft Graph backed cmdlets silently ignoring a failed request when the error response could be parsed but did not contain any error details. #5421
• Fixed Resolve-PnPFolder cmdlet not working in large lists and document library due to 5000 items threshold. #5411
• Fixed Set-PnPDefaultColumnValues corrupting library defaults on invalid taxonomy values. #5412
• Fixed New-PnPTeamsTeam sporadically failing with Not Found (404): Resource '<id>' does not exist or one of its queried reference-property objects are not present. while the team was in fact created. #5426
• Fixed Get-PnPFile mangling file names containing URL encoding sequences. #5413
• Fixed Get-PnPFile -AsFile and -AsMemoryStream, Get-PnPFileVersion, Remove-PnPFileVersion, Restore-PnPFileVersion, Convert-PnPFile, Get-PnPFileAnalyticsData, Set-PnPFileCheckedIn, Set-PnPFileCheckedOut, Undo-PnPFileCheckedOut, Get-PnPFileRetentionLabel and Get-PnPFileSensitivityLabel not reaching a file whose name literally holds a URL encoding sequence such as %20, acting on a differently named file instead. -Url is now taken as provided when a file exists there and only decoded when it does not. Where both names exist, the literal one wins. #5441
• Fixed Get-PnPFileRetentionLabel and Get-PnPFileSensitivityLabel rejecting a -Url relative to the web, such as Shared Documents/file.docx, which they resolved and then discarded. #5441

Removed

Contributors

• [svermaark]
• Fabian Hutzli [fabianhutzli]
• [reusto]
• Patrick Schneider [pschneid]