azurepowershellsharepointrunbook

PnP Powershell Add-PnPOffice365GroupToSite Authorization_RequestDenied Azure Runbook

We are using an Azure Runbook with PnP PowerShell to automate provisioning of SharePoint Online and O365 groups.

To connect and authenticate through PnP PowerShell, we are using an AppId and AppSecret that have assigned to an Azure Run As account.

Connecting to PnP Powershell through the Connect-PnPOnline command passing in the AppId and AppSecret works nicely.

We are then able to create a new site using New-PnPTenantSite, however when we go to create a group using Add-PnPOffice365GroupToSite we get the following error.

{"odata.error":{"code":"Authorization_RequestDenied","message":{"lang":"en","value":"Insufficient privileges to 
complete the operation."},"requestId":"fd2a5b37-98ea-40ab-bf39-5db8fafe9057","date":"2020-02-05T13:04:08"}}
At line:75 char:1
+ Add-PnPOffice365GroupToSite -Url "$siteFullUrl" -Alias "$MailboxName" ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : WriteError: (:) [Add-PnPOffice365GroupToSite], ServerException
    + FullyQualifiedErrorId : EXCEPTION,SharePointPnP.PowerShell.Commands.Admin.AddOffice365GroupToSite

We have granted SharePoint tenant management privileges through the /_layouts/AppInv.aspx page, and also provided API access directly to the AppRegistration in Azure. We have assigned most permissions that relate to Groups, Sites and AD, however continue to receive the error above.

Does anyone have any info on what API permissions we need to assign to this app registration to allow it to create the office 365 group using this method?

API Permissions

The above screenshot shows the API permissions assigned to the app registration.

Solution

  • It turns out that certain operations require user interaction for auditing purposes - group creation being one of them.

    Reference here with an answer from Andrew Connell -> https://github.com/SharePoint/sp-dev-docs/issues/3799