Authentication and Sharepoint config automation with registered app identity

[gquintana]

I would like to automate Sharepoint sites configuration, basically calling:

Grant-PnPAzureADAppSitePermission -AppId $appId -DisplayName $appName -Permissions $permissions

It's OK when I use interactive connection:

Connect-PnPOnline -Url $siteUrl -Interactive

But I'd like to go further in automation and not use a human credentials and rather use a technical account provided by a RegisteredApp with Sites.FullControl.All autorisation. I tried both:

Connect-PnPOnline -Url $siteUrl -ClientId $admClientId -ClientSecret $admClientSecret
Connect-PnPOnline -Url $siteUrl -ClientId $admClientId -CertificatePath $admClientCertPath -CertificatePassword admClientCertPassword

Where $admclientSecret, $admClientCertPath, $admClientCertPassword are the ones provided in registered app certificates & secrets.
Sadly both of them fail with error

Grant-PnPAzureADAppSitePermission : This cmdlet does not work with a ACS based connection towards SharePoint.

+ Grant-PnPAzureADAppSitePermission -AppId $appId -DisplayName $appName ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation : (:) [Grant-PnPAzureADAppSitePermission], PSInvalidOperationException
    + FullyQualifiedErrorId : InvalidOperation,PnP.PowerShell.Commands.Apps.GrantPnPAzureADAppSitePermission

How can I authenticate using a registered app account and be able to use Grant-PnPAzureADAppSitePermission operation

[AndersRask]

Hi,
could you double check that it does not work with a working certificate based client id?
the error you are getting is because the connection was made using AppInv/ACS which is legacy auth (also known as SharePoint App-Only).

Maybe try and make a new app reg with a certificate and granted Sites.FullControl.All
You could go for the CertificateBase64Encoded parameterset to rule out cert install.
Connect to test that it works (eg fetch Get-PnPTenant)
Try the cmdlet again.