0

So far I mostly used PnP provisioning with interactive login (=a user logs in) which worked fine.

I now want to PnP-provision some folders and content types using application permissions with the least permissions possible. Also, MS Graph should be used.

To connect I use a certificate and clientId of my app:

Connect-PnPOnline -Url "https://tenant.sharepoint.com/sites/thesite" -Tenant "tenant.onmicrosoft.com" -ClientId <id of AAD registered app> -Thumbprint <cert thumbprint>

It connects fine.

But I am not able to do much using PnP cmdlets. So far I tried using Sites.ReadWrite.All and Sites.Manage.All as app permission but was not able to create event a single list item using New-PnPListItem. Far away from Invoke-PnPSiteTemplate. I always get 401 errors:

Add-PnPListItem: The remote server returned an error: (401) Unauthorized.

Is there a certain minimal Graph permission level that needs to be present for PnP to work at all? Is a minimal permission approach feasable when working with PnP?

I'm aware that more permissions are needed the more I want to do in SharePoint. But for SharePoint there are not so many available: enter image description here

For basic stuff I'd expect Sites.ReadWrite.All or Sites.Manage.All to succeed. Or not?

Improve this question

1 Answer 1

Reset to default
1

You need to choose SharePoint API permissions instead of Graph permissions

enter image description here

Improve this answer
4

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.