Sites.Selected Permission with Managed Identity

[bckrma]

Hello community,
i am currently working on a powershell script executed in a powershell 7.2 azure automation runbook.
The scripts authenticates using a managed identity and the sites.selected permission, but my cmdlets fail with an 401 error.
Before i open an issue for this i would like to make sure my approach is even supported.

Setup

• Azure Automation Account with powershell 7.2 runbook
• System assigned managed identity and Sites.Selected permission for Graph and Office 365 SharePoint Online
• 'write' role for the managed identity on the target site

Script

$Connection = Connect-PnPOnline -Url $SiteURL -ManagedIdentity -ReturnConnection -verbose -debug 
$List = Get-PnpList -Connection $Connection -verbose -debug
$ListItems = Get-PnPListItem -List $ListName -Connection $Connection -verbose -debug
$Connection = $null

Output:

Checking for updates, current version is 2.1.1. See https://pnp.github.io/powershell/articles/configuration.html#disable-or-enable-version-checks for more information.
No newer version of PnP PowerShell is available
Connecting using Managed Identity
Acquiring token for resource https://tenantname.sharepoint.com
Using scope https://tenantname.sharepoint.com for managed identity token coming from the passed in default resource
Using identity endpoint: http://localhost:80/metadata/identity/oauth2/token
Using identity header: MSIHeaderValue
Using the system assigned managed identity
Sending token request to http://localhost:80/metadata/identity/oauth2/token?resource=https://tenantname.sharepoint.com&api-version=2019-08-01
PnP PowerShell Cmdlets (2.1.1)

Get-PnPList: 
Line |
  27 |  $List = Get-PnpList -Connection $Connection -verbose -debug
     |          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Attempted to perform an unauthorized operation.

Get-PnPListItem: 
Line |
  28 |  … ListItems = Get-PnPListItem -List $ListName -Connection $Connection - …
     |                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Attempted to perform an unauthorized operation.

Is it supported to use a managed identity with the sites.selected permission like this, or is my approach wrong?

Thanks a lot!

EDIT:
I have tested a few more things:

• Acquired an access token with Get-PnPAccessToken using the managed Identity and decoded it
  • 'Sites.Selected' is listed under 'roles'
  • 'app_displayname' matches the DisplayName of the managed identity
  • 'appid' matches the app id of the managed identity
• Validated the Sites.Selected 'write' role on the site using Get-PnPAzureADAppSitePermission -AppIdentity $ManagedIdentityObjectID

[meklulose]

@bckrma I am facing the same issue. Were you able to get this resolved?

[bckrma]

unfortunately not, but at this point I assume it is not supported.
I tested a little further, and even if you use the powershell graph sdk, or if you call the graph api directly, the requests continues to fail with an 401 error.
Please let me know if you find out anything else

[nicole-ge]

Hi @bckrma @meklulose could you find any Solution?

[Barbarur]

How did you granted the permissions to the target site?

[nicole-ge]

Hi @Barbarur
Look here link there you find how grant permission to target spo site

[IoannisGianko]

I've got the same issue

Use the object ID of the managed identity

$appObjectId = ""
Add-PnPAzureADServicePrincipalAppRole -Principal $appObjectId -AppRole "Sites.Selected" -BuiltInType SharePoint

Use the App ID of the managed identity

$appId = ""
Grant-PnPAzureADAppSitePermission -AppId $appId -DisplayName "AppName" -Permissions FullControl -Site https://contoso.sharepoint.com/sites/projects