[Documentation] User Access & Permissions

[DragonHiei]

Hello,

I have reviewed the https://pnp.github.io/powershell/articles/authentication.html page and it is unclear to me what permissions a user will have after setting up access. This is for a normal off the shelf O365 environment in the US, not a GCC or National Cloud Environment. I would imagine it is one of the following:

1. any user using the commands now gains full access to the list of permissions outlined when you run "Register-PnPManagementShellAccess" as non-global admin.
2. users only have access to what they already had access to and they do not gain any new access from using the commands.
3. user access is defined and can be restricted at the enterprise app / app registration level.

Thanks

[gautamdsheth]

1 and 2 :)

The PnP Management Shell is a multi-tenant app with delegated only permissions.
So, when the user uses that, the permissions of the user + app will be considered. They have access only to the stuff for which they have permissions.

For restricting permissions at App level, you should use Register-PnPAzureADApp and specify the permissions.

Moving this to discussion since that is the correct place for this conversation.

[DragonHiei]

Hey @gautamdsheth thank you for the info. After doing more research and refencing, let me know if I am understanding this correctly:

• https://sharepoint.stackexchange.com/questions/292342/unwanted-permission-requested-by-azure-ad-consent-for-pnp-powershell
• https://github.com/Zerg00s/PowerShellPnP-AppAuthentication
• https://pnp.github.io/pnpcore/using-the-sdk/configuring%20authentication.html

there are 2 options for authentication user and device:

• if using user (user/password) that uses delegate permissions + app permissions (possible through Register-PnPManagementShellAccess or Register-PnPAzureADApp with Allow public client flows to yes
• if using device (cert) that uses app permissions (possible through Register-PnPAzureADApp)

If using device, you are only limited but what the app permissions are? If using an user, you are limited by the app and the user itself? So for optimal access control user is the preferred route.

If that is all true so far, isn't it true that to use Register-PnPAzureADApp you would still need to use Register-PnPManagementShellAccess?

So something like:

1. Register-PnPManagementShellAccess
2. Register-PnPAzureADApp
3. set Allow public client flows to yes
4. Use Connect-PnPOnline with a username and password

Is it possible to remove the app that Register-PnPManagementShellAccess creates after step 3 and a user would still be able to login?