Attempted to perform an unauthorized operation / Rights issue using PnP Powershell 7

[jerome-dl]

Hi Team,

At first, I would like to apologize in advance, as I'm afraid my question is a newbie question. However, I spend hours crawling the web to get some help and was not able to succeed, so here I am!

Context

I'm expecting to have PnP Powershell (latest) working on a Win10 server with Powershell 7.2.2, with Office 365.

Connection

The connection phase works well:
> Connect-PnPOnline -Url https://[mytenant].sharepoint.com -Credentials $O365Credential
and I can see the successful connection in Azure AD connection log for PnP Management Shell app.

For connection, I'm using the credential of a specific admin account, which as sufficient rights for accessing the SharePoint file I want to download (tested successfully using the web access to Office 365).

Issue

When trying to retrieve a file (I tried a couple of other commands with the same result), I have an immediate issue:

> Get-PnPFile -Url "/sites/DCX/IT/Documents/myFile.xlsm"
Get-PnPFile: Attempted to perform an unauthorized operation.

At this time, I was not able to locate any place where I could get additional logs to understand the root cause of the issue.
Where should I check for what might have been incorrectly installed, configured or set?

Thanks in advance for your help!
Jérôme

[jerome-dl]

(Still expecting some guidance... thanks!)

I tried to get additional clues to understand my issue, but this was not very fruitful:

`>Get-PnPFile -Url "/sites/(...)/(...).xlsm"
Get-PnPFile: Attempted to perform an unauthorized operation.

Get-PnPDiagnostics

Version : 1.10.0.0
ModulePath : C:\Program Files\PowerShell\Modules\PnP.PowerShell\1.10.0\Core
OperatingSystem : Microsoft Windows NT 10.0.17763.0
ConnectionMethod : Credentials
CurrentSite : https://(...).sharepoint.com/
LastCorrelationId : fe8339a0-6008-3000-dfc6-5d50e9563c2d
LastExceptionTimeStampUtc : 02/05/2022 18:40:36
LastExceptionMessage : Attempted to perform an unauthorized operation.
LastExceptionStacktrace : at Microsoft.SharePoint.Client.ClientRequest.ProcessResponseStream(Stream
responseStream)
at Microsoft.SharePoint.Client.ClientRequest.ProcessResponse()
at
Microsoft.SharePoint.Client.ClientRequest.ExecuteQueryToServerAsync(ChunkStringBuilder
sb)
at Microsoft.SharePoint.Client.ClientRequest.ExecuteQueryAsync()
at Microsoft.SharePoint.Client.ClientRuntimeContext.ExecuteQueryAsync()
at Microsoft.SharePoint.Client.ClientContext.ExecuteQueryAsync()
at Microsoft.SharePoint.Client.ClientContextExtensions.ExecuteQueryImplementation(Cl
ientRuntimeContext clientContext, Int32 retryCount, String userAgent)
at Microsoft.SharePoint.Client.ClientContextExtensions.ExecuteQueryRetry(ClientRunti
meContext clientContext, Int32 retryCount, String userAgent)
at PnP.PowerShell.Commands.PnPWebCmdlet.GetWeb() in
c:\build\src\Commands\Base\PnPWebCmdlet.cs:line 64
at PnP.PowerShell.Commands.PnPWebCmdlet.get_CurrentWeb() in
c:\build\src\Commands\Base\PnPWebCmdlet.cs:line 36
at PnP.PowerShell.Commands.Files.GetFile.ExecuteCmdlet() in
c:\build\src\Commands\Files\GetFile.cs:line 74
at PnP.PowerShell.Commands.PnPSharePointCmdlet.ProcessRecord() in
c:\build\src\Commands\Base\PnPSharePointCmdlet.cs:line 60
LastExceptionScriptLineNumber : 1
`

Was it?
Thanks for your help in advance.

[chuushi]

I found that error when I ran PnP commands as a user that does not own the SharePoint site. Maybe try changing/adding the user in $O365Credential as the site owner?

It's most likely an access permission issue.

[jerome-dl]

Hi there,

I should have reported sooner that I solved the issue by changing the way I connect. I thought a "global" connection on Sharepoint was possible but it needs to be more specific.

Doesn't work:

Connect-PnPOnline -Url https://[mytenant].sharepoint.com -Credentials $O365Credential
Get-PnPFile -Url "/sites/[myrootsite]/[mysite]/Documents/...blabla...xlsm"

Works:

Connect-PnPOnline -Url "https://[mytenant].sharepoint.com/sites/[myrootsite]/[mysite]"
Get-PnPFile -Url "Documents/...blabla.....xlsm"

So, I need to proceed with various Connect-PnPOnline when needing to access different subsites of my SharePoint structure.

[JonoSuave]

I'm having a similar issue, although I'm running my PowerShell script via an Azure function with a system managed identity. My goal is to checkin Site Pages items that have no checked in version. The managed identity has both Graph and SharePoint ReadWrite and site full control permissions. When I run Invoke-PnPQuery, however, I get the following error: "ERROR: Attempted to perform an unauthorized operation." Here's my HttpTriggered Azure Function:
`using namespace System.Net

Input bindings are passed in via param block.

param($Request, $TriggerMetadata)

Write to the Azure Functions log stream.

Write-Host "PowerShell HTTP trigger function processed a request."

Interact with query parameters or the body of the request.

$libraryName = $Request.Query.LibraryName
if (-not $libraryName) {
$libraryName = $Request.Body.LibraryName
}

$siteUrl = $Request.Query.SiteUrl
if (-not $siteUrl) {
$siteUrl = $Request.Body.SiteUrl
}

$body = "This HTTP triggered function executed successfully. Pass a name in the query string or in the request body for a personalized response."

if ($siteUrl) {
Connect-PnPOnline -Url $siteUrl -ManagedIdentity
$context = Get-PnPContext
$list = Get-PnPList -Identity $libraryName
$listItems = Get-PnPListItem -List $list.Id
ForEach($item in $listItems) {
Write-Host $item.Id -Verbose
}

# Load the checked out files

$checkedOutFiles = $list.GetCheckedOutFiles()
$context.Load($checkedOutFiles)
Invoke-PnPQuery

ForEach($item in $checkedOutFiles) {
    Write-Host $item.Id -Verbose
}

    $libraryId = $list.Id
    $checkedOutFiles
    $body = "Hello, $listItems"

}

Associate values to output bindings by calling 'Push-OutputBinding'.

Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
StatusCode = [HttpStatusCode]::OK
Body = $body
})
`