I want to create a new sitecollection with PnP Powershell and created an App with /_layouts/15/appregnew.aspx and granted permissions with: /_layouts/15/appinv.aspx.

This is my permission request xml:

<AppPermissionRequests AllowAppOnlyPolicy="true">
    <AppPermissionRequest Scope="http://sharepoint/content/tenant" Right="FullControl" />

The script is basically:

Connect-PnPOnline -Url $tenantAdminUrl -AppId $AppID -AppSecret $AppSecret 

New-PnPTenantSite -Title "title" -Url $newSitename -Owner $adminUser -TimeZone 4 -Force -Wait -Template "STS#0"

Errormessage is:

New-PnPTenantSite : Der Remoteserver hat einen Fehler zurückgegeben: (401) Nicht autorisiert.
In C:\Users\xxx\script.ps1:112 Zeichen:4
+ New-PnPTenantSite -Title $projectItem["Title"] -Url $newS ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : WriteError: (:) [New-PnPTenantSite], WebException
+ FullyQualifiedErrorId: EXCEPTION,SharePointPnP.PowerShell.Commands.NewTenantSite

Tenant scope and FullControl but i get 401 error? How can i get the app permissions to deploy sitecollections?

Workaround with user account:

$secpasswd = ConvertTo-SecureString "PlainTextPassword" -AsPlainText -Force
$mycreds = New-Object System.Management.Automation.PSCredential ("username", $secpasswd)
Connect-PnPOnline -Url $tenantAdminUrl -Credentials $mycreds
  • When you added the app, did you request approval from the tenant administrator? If you are a tenant administrator or SharePoint Online Admin, you can approve your own request. In my experience, you have to be a tenant administrator to be able to give tenant-scoped permissions. – Kevin Stone Jul 7 '17 at 13:00
  • I did approve the app and it should have the tenant-scoped permissions. – Alex Jul 7 '17 at 15:40
  • You can try two things if not ready tried 1) ensure that you are running 64bit PowerShell and 2) run as administrator – SharePointer Jul 7 '17 at 22:02
  • Are you a tenant administrator? You can still approve as a SharePoint Online administrator, but the access wont actually work unless you are a tenant admin – Kevin Stone Jul 15 '17 at 1:50

401 Unauthorized Access: The error itself says that its an Authentication problem not Authorization problem.

The account by which you are using app may not have the rights to create a Site Collection.

So please first verify the permission for the logged in user whether user has rights to create site collection or not.

  • 1
    I read lists before the New-PnPTenantSite part. Get-PnPListItem -List works fine. New-PnPTenantSite not. I don't get it. – Alex Jul 7 '17 at 12:18
  • There is no user. The app should have to rights to do it:Connect-PnPOnline -Url $tenantAdminUrl -AppId $AppID -AppSecret $AppSecret – Alex Jul 19 '17 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.