So far I mostly used PnP provisioning with interactive login (=a user logs in) which worked fine.
I now want to PnP-provision some folders and content types using application permissions with the least permissions possible. Also, MS Graph should be used.
To connect I use a certificate and
clientId of my app:
Connect-PnPOnline -Url "https://tenant.sharepoint.com/sites/thesite" -Tenant "tenant.onmicrosoft.com" -ClientId <id of AAD registered app> -Thumbprint <cert thumbprint>
It connects fine.
But I am not able to do much using PnP cmdlets. So far I tried using
Sites.Manage.All as app permission but was not able to create event a single list item using
New-PnPListItem. Far away from
Invoke-PnPSiteTemplate. I always get 401 errors:
Add-PnPListItem: The remote server returned an error: (401) Unauthorized.
Is there a certain minimal Graph permission level that needs to be present for PnP to work at all? Is a minimal permission approach feasable when working with PnP?
For basic stuff I'd expect
Sites.Manage.All to succeed. Or not?