azureoffice365sharepoint-onlineazure-app-registration

Unable to define the sites for an App Registration for SahrePoint with Site.Selected

I have this App registration inside Azure with Site.Selected for SharePoint online:-

enter image description here

I want to define the sites for the above "Sites.Selected", so I tried the following:-

$siteUrl = "https://*.sharepoint.com/sites/integration-prod"

$clientId = "2**0a"

$certThumbprint = "7**EA"

$tenant = "**.onmicrosoft.com"

Connect-PnPOnline -Url $siteUrl -ClientId $clientId -Thumbprint $certThumbprint -Tenant $tenant

$writeperm = Grant-PnPAzureADAppSitePermission -Permissions "Write" -Site $siteUrl -AppId $clientId -DisplayName "SPGPIntegration-Test"

$PermissionId = Get-PnPAzureADAppSitePermission -AppIdentity $clientId

Set-PnPAzureADAppSitePermission -Site $siteurl -PermissionId $(($PermissionId).Id) -Permissions "FullControl"

But I got these errors:-

enter image description here

Grant-PnPAzureADAppSitePermission: {"error":{"code":"AccessDenied","message":"Either scp or roles claim need to be present in the token.","innerError":{"date":"2024-09-17T14:01:55","request-id":"38072694-80cf-4235-9b4c-3d0335ee72ff","client-request-id":"38072694-80cf-4235-9b4c-3d0335ee72ff"}}}

Get-PnPAzureADAppSitePermission: Forbidden (403): Either scp or roles claim need to be present in the token.   

Set-PnPAzureADAppSitePermission: Cannot validate argument on parameter 'PermissionId'. The argument is null or empty. Provide an argument that is not null or empty, and then try the command again.

any advice on this please?

Thanks EDIT

I also tried with an App Registration which have full control but got the exact error , here what i tried, so i have 2 client IDs (one for the App registration with full control , while the other for the App registration which have Site.Selected), as mentioned in the description:-

$siteUrl = "https://*****"

$clientId = "Client ID For the App Registration which have full control"

$certThumbprint = "Thumbprint For the App Registration which have full control"

$tenant = "****.onmicrosoft.com"

connect-PnPOnline -Url $siteUrl -ClientId $clientId -Thumbprint $certThumbprint -Tenant $tenant

$writeperm = Grant-PnPAzureADAppSitePermission -Permissions "Write" -Site $siteUrl -AppId "Client ID For the App Registration which have Sites.Seleced" -DisplayName "SPGPIntegration-Test"

$PermissionId = Get-PnPAzureADAppSitePermission -AppIdentity "Client ID For the App Registration which have Sites.Seleced""

Set-PnPAzureADAppSitePermission -Site $siteurl -PermissionId $(($PermissionId).Id) -Permissions "FullControl"

but got the exact same error...

Solution

  • Created a Microsoft Entra ID Application and granted same API permissions as you:

    enter image description here

    When tried the script got the same errors:

    enter image description here

    To resolve the error, you need to grant Microsoft Graph Sites.FullControl.All application type API permission to the application

    enter image description here

    After granting the API permission I am able to do the operations successfully by modifying the script like below:

    $siteUrl = "https://XXX.sharepoint.com/sites/testrukk"

$appName = "SharePointPnPApp"

$clientId = "ClientID"

$certThumbprint = "XXX"

$tenant = "XXX.onmicrosoft.com"

Connect-PnPOnline -Url $siteUrl -ClientId $clientId -Thumbprint $certThumbprint -Tenant $tenant


if ($permission -ne 'FullControl' ) {
    Grant-PnPAzureADAppSitePermission -AppId $clientId -DisplayName $appName -Site $siteUrl -Permissions "Write"
}
else {
    Grant-PnPAzureADAppSitePermission -AppId $clientId -DisplayName $appName -Site $siteUrl -Permissions Write
    $PermissionId = Get-PnPAzureADAppSitePermission -AppIdentity $appId
    Set-PnPAzureADAppSitePermission -Site $siteUrl -PermissionId $(($PermissionId).Id) -Permissions FullControl
}

Get-PnPAzureADAppSitePermission -Site "https://XXX.sharepoint.com/sites/testrukk"

    enter image description here

    Reference:

    Grant-PnPAzureADAppSitePermission | PnP PowerShell