[BUG] Request-PnPPersonalSite - ERROR: The remote server returned an error: (403) Forbidden.

[ITAndy23]

Reporting an Issue or Missing Feature

Error running command
Request-PnPPersonalSite -UserEmails $Upn

• ERROR: The remote server returned an error: (403) Forbidden.

Expected behavior

Expect the command to provision the OneDrive site

Actual behavior

HResult : -2146233087CategoryInfo : InvalidOperation: (:) [Request-PnPPersonalSite], PSInvalidOperationExceptionFullyQualifiedErrorId : InvalidOperation,PnP.PowerShell.Commands.Admin.RequestPersonalSiteException: The remote server returned an error: (403) Forbidden.Stack:

Steps to reproduce behavior

Connect-PnPOnline -Url 'https://$Tenant-admin.sharepoint.com' -ClientId $ClientId -ClientSecret $ClientSecret
Request-PnPPersonalSite -UserEmails $Upn

ClientId and Secret were generated via SPO
ClientId was giving the following permission:
<AppPermissionRequests AllowAppOnlyPolicy="true"> <AppPermissionRequest Scope="http://sharepoint/social/tenant" Right="FullControl" /> </AppPermissionRequests>

What is the version of the Cmdlet module you are running?

1.12.0

Which operating system/environment are you running PnP PowerShell on?

• [] Windows
• Linux
• MacOS
• Azure Cloud Shell
• [ X] Azure Functions
• Other : please specify

[gautamdsheth]

Access denied is a permission issue and not an issue with the module itself.
Looks like you might need to provide some more permissions or use a different authentication method for this , would recommend using an Azure AD app.

Moving this to discussion forum since it is a permission issue and nothing to do with the module itself

[ITAndy23]

I've tried both; an Azure AD app registration and a SharePoint Online app registration;
Followed documentation here: https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly
With the Azure App Registration I provided Sites.FullControl.All API Permission. Type is Application and admin consented. I generated the secret. Using the secret and the client id, i plugged them into the variables above in my script. Same error.

Using SPO App Reg,
Navigated to New App Registration https://$Tenant.sharepoint.com/_layouts/15/appregnew.aspx
Generated client id and secret. Made up a Title. Provided the following for the other two fields:
App Domain: www.localhost.com
Redirect URI: https://www.localhost.com

Navigated to Grant Permission https://$Tenant-admin.sharepoint.com/_layouts/15/appinv.aspx
Looked up the app id and provided the following permissions:
<AppPermissionRequests AllowAppOnlyPolicy="true"> <AppPermissionRequest Scope="http://sharepoint/social/tenant" Right="FullControl" /> </AppPermissionRequests>
Then connect with:
Connect-PnPOnline -Url 'https://$Tenant-admin.sharepoint.com' -ClientId $ClientId -ClientSecret $ClientSecret
The connection works with either option.

Provisioning OneDrive fails using the following command:
Request-PnPPersonalSite -UserEmails $Upn

[gautamdsheth]

For new app registration, you need to create it in here: https://$Tenant-admin.sharepoint.com/_layouts/15/appregnew.aspx and then grant permissions there.

Check this link:

https://pnp.github.io/powershell/cmdlets/Request-PnPPersonalSite.html#description

[ITAndy23]

I recreated the app registration for SPO with the link you provided. Permissioned it using:
<AppPermissionRequests AllowAppOnlyPolicy="true"> <AppPermissionRequest Scope="http://sharepoint/social/tenant" Right="FullControl" /> </AppPermissionRequests>

I can still connect to pnp but now I'm getting a different error when hitting Request-PnPPersonalSite -UserEmails $Upn :
Attempted to perform an unauthorized operation.HResult : -2146233087CategoryInfo : InvalidOperation: (:) [Request-PnPPersonalSite], PSInvalidOperationExceptionFullyQualifiedErrorId : InvalidOperation,PnP.PowerShell.Commands.Admin.RequestPersonalSiteException: Attempted to perform an unauthorized operation.Stack:

[jeremyaltman]

Were you able to find any solution for this? I am currently experiencing the exact same issues you have described, first received the (403) Forbidden, now the error is: Request-PnPPersonalSite : Attempted to perform an unauthorized operation.

The documentation gautamdsheth linked above on 11/15/2022 states "It does not require assigning any permissions in Azure Active Directory."

[ztrhgf]

Same behavior when Connect-PnPOnline -Url $url -Interactive -ForceAuthentication was used for authentication. If Connect-PnPOnline -Url $url -UseWebLogin -ForceAuthentication is used, error "Attempted to perform an unauthorized operation" is not thrown.

[Null-Fault]

Additionally behavior also occurs with Connect-PnPOnline -Url $Url -DeviceLogin. Behavior does not occur Connect-PnPOnline -Url $url -UseWebLogin -ForceAuthentication (Thank you @ztrhgf for the workaround.)