Unwanted permission requested by Azure AD Consent for PnP PowerShell

Question

I am trying to register PnP PowerShell Enterprise app and currently app is requesting 27 different permissions . I would like minimize the number of permissions requested by PnP PowerShell . In my client tenant, I just have just SharePoint Admin role not the Global Admins or Application Admin Role.

I had generated consent URL using the below PnP command and shared with global admins then the request has been rejected by Azure Admin(Global Admin) since PnP requesting excess permission which is not relevant to the task I'm working.

Register-PnPManagementShellAccess -ShowConsentUrl

Is there any way to limit the permission to SharePoint and Graph API's ?

Any help would be much appreciated on this issue and thank you in advance.

Answer 1

PnP Management shell is a multi-tenant application and so you can't control its permissions.

However, you can ask the Admins to create the Azure AD application with permissions that you need.

Once that application is created, you can use that application's client ID and connect as below:

Connect-PnPOnline "<url>" -Interactive -ClientId "<your-client-id>"

PnP PowerShell requires a Azure AD application not necessarily the PnP Management Shell app.

Having said that, PnP Management Shell only asks for Delegated permissions. So, even if the permissions seem excessive, it won't allow you to do things for which you dont have rights

Answer 2

It's easier to create your own Azure App registration with permissions you actually need.Here is an example of a nice script that does it by simply double-clicking a batch file.

If you specify the exact permissions you want by updating the requiredResourceManifest.json file before running the script.

[
  {
    "resourceAppId": "00000003-0000-0ff1-ce00-000000000000",
    "resourceAccess": [
        {
            "id": "678536fe-1083-478a-9c59-b99265e6b0d3",
            "type": "Role"
        },
        {
            "id": "c8e3537c-ec53-43b9-bed3-b2bd3617ae97",
            "type": "Role"
        },
        {
            "id": "741f803b-c850-494e-b5df-cde7c675a1ca",
            "type": "Role"
        }
    ]
  },
  {
    "resourceAppId": "00000002-0000-0000-c000-000000000000",
    "resourceAccess": [
        {
            "id": "311a71cc-e848-46a1-bdf8-97ff7156d8e6",
            "type": "Scope"
        }
    ]
  }
]