I want to create a new sitecollection with PnP Powershell and created an App with /_layouts/15/appregnew.aspx and granted permissions with: /_layouts/15/appinv.aspx.

This is my permission request xml:

<AppPermissionRequests AllowAppOnlyPolicy="true">
    <AppPermissionRequest Scope="http://sharepoint/content/tenant" Right="FullControl" />

The script is basically:

Connect-PnPOnline -Url $tenantAdminUrl -AppId $AppID -AppSecret $AppSecret 

New-PnPTenantSite -Title "title" -Url $newSitename -Owner $adminUser -TimeZone 4 -Force -Wait -Template "STS#0"

Errormessage is:

New-PnPTenantSite : Der Remoteserver hat einen Fehler zurückgegeben: (401) Nicht autorisiert.
In C:\Users\xxx\script.ps1:112 Zeichen:4
+ New-PnPTenantSite -Title $projectItem["Title"] -Url $newS ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : WriteError: (:) [New-PnPTenantSite], WebException
+ FullyQualifiedErrorId: EXCEPTION,SharePointPnP.PowerShell.Commands.NewTenantSite

Tenant scope and FullControl but i get 401 error? How can i get the app permissions to deploy sitecollections?

Workaround with user account:

$secpasswd = ConvertTo-SecureString "PlainTextPassword" -AsPlainText -Force
$mycreds = New-Object System.Management.Automation.PSCredential ("username", $secpasswd)
Connect-PnPOnline -Url $tenantAdminUrl -Credentials $mycreds
  • When you added the app, did you request approval from the tenant administrator? If you are a tenant administrator or SharePoint Online Admin, you can approve your own request. In my experience, you have to be a tenant administrator to be able to give tenant-scoped permissions. Jul 7 '17 at 13:00
  • I did approve the app and it should have the tenant-scoped permissions.
    – Axel
    Jul 7 '17 at 15:40
  • You can try two things if not ready tried 1) ensure that you are running 64bit PowerShell and 2) run as administrator Jul 7 '17 at 22:02
  • 1
    Are you a tenant administrator? You can still approve as a SharePoint Online administrator, but the access wont actually work unless you are a tenant admin Jul 15 '17 at 1:50
  • Did you find an answer to this issue? I have the exact same issue with permissions. According to the documentations, sites.fullAccess.all only gives rights to perform actions on existing sites, not create new ones.... Can't find any other options that gives higher level permission....
    – Ola Malnes
    Sep 9 '20 at 10:03

401 Unauthorized Access: The error itself says that its an Authentication problem not Authorization problem.

The account by which you are using app may not have the rights to create a Site Collection.

So please first verify the permission for the logged in user whether user has rights to create site collection or not.

  • 2
    I read lists before the New-PnPTenantSite part. Get-PnPListItem -List works fine. New-PnPTenantSite not. I don't get it.
    – Axel
    Jul 7 '17 at 12:18
  • There is no user. The app should have to rights to do it:Connect-PnPOnline -Url $tenantAdminUrl -AppId $AppID -AppSecret $AppSecret
    – Axel
    Jul 19 '17 at 14:29
  • 1
    Unauthorized sounds to me as an authorization issue
    – gsscoder
    Feb 22 at 12:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.