Change from Certificate based authentication to Managed Identities causing issues???

[myatix]

I resently tried upgrading my PnP.Provisioning script to use PnP.Powershel v2 and Managed Identities... (I am starting to wish I hadn't)

I am getting a lot of 401 errors presumable because the Function App Managed Identity doesn't have access... BUT... I have followied the guidance provided by the PnP.Powershell community and it just doesn't work.

https://pnp.github.io/powershell/articles/azurefunctions.html

First of all this section is incorrect if you are using managed identities...

You need to have the following uncommented.

if ($env:MSI_SECRET) {
    Disable-AzContextAutosave -Scope Process | Out-Null
    Connect-AzAccount -Identity
}

#Import Modules into Function App
Import-Module -Name Az.Accounts
Import-Module -Name PnP.PowerShell

I have also granted access to the managed identity using the following script:

# The ID of your Azure Function system-managed identity
$miObjectID = "3a1f64fd-d46f-4eb5-b538-17a4bea4105a"

# The app ID of the SharePoint Online API; same in all tenants
$appId = "00000003-0000-0ff1-ce00-000000000000"

# Replace with the API permissions required by your script; separate multiple permissions with a comma
$permissionsToAdd = "Sites.FullControl.All"

Connect-AzureAD

$app = Get-AzureADServicePrincipal -Filter "AppId eq '$appId'"

foreach ($permission in $permissionsToAdd)
{
   $role = $app.AppRoles | where Value -Like $permission | Select-Object -First 1
   New-AzureADServiceAppRoleAssignment -Id $role.Id -ObjectId $miObjectID -PrincipalId $miObjectID -ResourceId $app.ObjectId
}

But I am still getting the following error when trying to connect using:

$Site = Get-PnPTenantSite -Identity $webUrl -Connection $webConnect

2023-09-21T04:20:50Z [Information] OUTPUT: Exception :
2023-09-21T04:20:50Z [Information] OUTPUT: Type : System.Management.Automation.PSInvalidOperationException
2023-09-21T04:20:50Z [Information] OUTPUT: ErrorRecord :
2023-09-21T04:20:50Z [Information] OUTPUT: Exception :
2023-09-21T04:20:50Z [Information] OUTPUT: Type : System.Management.Automation.ParentContainsErrorRecordException
2023-09-21T04:20:50Z [Information] OUTPUT: Message : Unable to connect to the SharePoint Online Admin Center at 'https://mytenant-admin.sharepoint.com' to run this cmdlet. Please ensure you pass in the correct Admin Center URL using Connect-PnPOnline -TenantAdminUrl and you have access to it. Error message: The remote server returned an error: (401) Unauthorized..

Any advice would be appreciated..

[AndersRask]

Yes I think the Az issue was resolved in one of the recent builds by a complete rehaul of the assembly load patterns in the module.

As for the error, have you tried adding the TenantAdminUrl when you connect as the error suggests?

[myatix]

If I use the TenantAdminUrl like suggested I get the below error... Am I doing something wrong?

2023-09-21T21:57:30Z [Error] ERROR: Parameter set cannot be resolved using the specified named parameters. One or more parameters issued cannot be used together or an insufficient number of parameters were provided.

Exception :
Type : System.Management.Automation.ParameterBindingException
Message : Parameter set cannot be resolved using the specified named parameters. One or more parameters issued cannot be used together or an insufficient number of parameters were provided.
ErrorId : AmbiguousParameterSet
Line : 22
Offset : 15
CommandInvocation :
MyCommand : Connect-PnPOnline
BoundParameters :
Comparer : System.OrdinalIgnoreCaseComparer
Count : 3
Keys :
Length : 14

            Length : 15

            Length : 16
        Values   : 
            Length : 34

            IsPresent : True

            IsPresent : True
        SyncRoot : 
            Comparer : System.OrdinalIgnoreCaseComparer
            Count    : 3
            Keys     : 
                Length : 14

                Length : 15

                Length : 16
            Values   : 
                Length : 34

                IsPresent : True

                IsPresent : True
            SyncRoot : 
                Comparer : System.OrdinalIgnoreCaseComparer
                Count    : 3
                Keys     : 
                    Length : 14

                    Length : 15

                    Length : 16
                Values   : 
                    Length : 34

                    IsPresent : True

                    IsPresent : True
                SyncRoot : 
                    Comparer : System.OrdinalIgnoreCaseComparer
                    Count    : 3
                    Keys     : 
                        Length : 14

                        Length : 15

                        Length : 16
                    Values   : 
                        Length : 34

                        IsPresent : True

                        IsPresent : True
                    SyncRoot : 
                        Comparer : System.OrdinalIgnoreCaseComparer
                        Count    : 3
                        Keys     : 
                            Length : 14

                            Length : 15

                            Length : 16
                        Values   : 
                            Length : 34

                            IsPresent : True

                            IsPresent : True
                        SyncRoot : 
                            Comparer : System.OrdinalIgnoreCaseComparer
                            Count    : 3
                            Keys     : 
                                Length : 14

                                Length : 15

                                Length : 16
                            Values   : 
                                Length : 34

                                IsPresent : True

                                IsPresent : True
                            SyncRoot : 
                                Comparer : System.OrdinalIgnoreCaseComparer
                                Count    : 3
                                Keys     : …
                                Values   : …
                                SyncRoot : …
    ScriptLineNumber : 22
    OffsetInLine     : 15
    HistoryId        : 1
    ScriptName       : C:\home\site\wwwroot\TeamSiteProvisioning\run.ps1
    Line             : $webConnect = Connect-PnPOnline -TenantAdminUrl $tenantAdminUrl -ManagedIdentity -ReturnConnection

[AndersRask]

Hi,

could you post your code, or relevant parts of it.
Also try and catch a trace log using
Set-PnPTraceLog -on

I haven't played a lot with managed identity in the new PnP yet, but it is my impression that everything isn't fully implemented and working yet (a Microsoft thing more likely than a PnP thing).

[myatix]

Hi @AndersRask,

For some reason the Managed Identity doesn't allow Get-PnPTenantSite??? It has no issue with Get-PnPWeb

#This works fine...
$webConnect = Connect-PnPOnline -Url https://tenant.sharepoint.com/sites/myweb -ManagedIdentity -ReturnConnection
# Diables Template Gallery dialog and Next Steps dialog for newly created sites in SharePoint
 $disableTemp = Get-PnPWeb -Includes NextStepsFirstRunEnabled, WebTemplatesGalleryFirstRunEnabled -Connection $webConnect
 $disableTemp.NextStepsFirstRunEnabled = $false
 $disableTemp.WebTemplatesGalleryFirstRunEnabled = $false
 $disableTemp.Update()
 Invoke-PnPQuery -Connection $webConnect

#This kicks an error if you connect to a regular web... It will only let me connect to the SPO Admin site, which is very experience from using a App Registration to connect.

$Site = Get-PnPTenantSite -Identity $webUrl -Connection $webConnect

Unfortunately I do not want to apply a PnPTemplate to the SPO Admin site. ;-)

2023-09-23T05:36:44Z [Information] INFORMATION: ERROR PROVISIONING SITE:
2023-09-23T05:36:44Z [Information] OUTPUT:
2023-09-23T05:36:44Z [Information] OUTPUT: Type : System.Management.Automation.PSInvalidOperationException
2023-09-23T05:36:44Z [Information] OUTPUT: Exception :
2023-09-23T05:36:44Z [Information] OUTPUT: ErrorRecord :
2023-09-23T05:36:44Z [Information] OUTPUT: Exception :
2023-09-23T05:36:44Z [Information] OUTPUT: Message : Unable to connect to the SharePoint Online Admin Center at 'https://yc0wh-admin.sharepoint.com' to run this cmdlet. Please ensure you pass in the correct Admin Center URL using Connect-PnPOnline -TenantAdminUrl and you have access to it. Error message: The remote server returned an error: (401) Unauthorized..
2023-09-23T05:36:44Z [Information] OUTPUT: HResult : -2146233087
2023-09-23T05:36:44Z [Information] OUTPUT: FullyQualifiedErrorId : InvalidOperation
2023-09-23T05:36:44Z [Information] OUTPUT: TargetSite :
2023-09-23T05:36:44Z [Information] OUTPUT: Name : BeginProcessing
2023-09-23T05:36:44Z [Information] OUTPUT: DeclaringType : PnP.PowerShell.Commands.Base.PnPAdminCmdlet
2023-09-23T05:36:44Z [Information] OUTPUT: Module : PnP.PowerShell.dll
2023-09-23T05:36:44Z [Information] OUTPUT: MemberType : Method
2023-09-23T05:36:44Z [Information] OUTPUT: CategoryInfo : InvalidOperation: (:) [], ParentContainsErrorRecordException
2023-09-23T05:36:44Z [Information] OUTPUT: InnerException :
2023-09-23T05:36:44Z [Information] OUTPUT: Type : System.Net.WebException
2023-09-23T05:36:44Z [Information] OUTPUT: Status : ProtocolError
2023-09-23T05:36:44Z [Information] OUTPUT: Response : System.Net.HttpWebResponse
2023-09-23T05:36:44Z [Information] OUTPUT: TargetSite :
2023-09-23T05:36:44Z [Information] OUTPUT: DeclaringType : System.Net.HttpWebRequest
2023-09-23T05:36:44Z [Information] OUTPUT: MemberType : Method
2023-09-23T05:36:44Z [Information] OUTPUT: Name : EndGetResponse
2023-09-23T05:36:44Z [Information] OUTPUT: Message : The remote server returned an error: (401) Unauthorized.
2023-09-23T05:36:44Z [Information] OUTPUT: Data : System.Collections.ListDictionaryInternal
2023-09-23T05:36:44Z [Information] OUTPUT: Source : System.Net.Requests
2023-09-23T05:36:44Z [Information] OUTPUT: HResult : -2146233079
2023-09-23T05:36:44Z [Information] OUTPUT: StackTrace :
2023-09-23T05:36:44Z [Information] OUTPUT: Module : System.Net.Requests.dll
2023-09-23T05:36:44Z [Information] OUTPUT: at System.Net.WebRequest.<>c.b__68_2(IAsyncResult iar)
2023-09-23T05:36:44Z [Information] OUTPUT: at System.Threading.Tasks.TaskFactory1.FromAsyncCoreLogic(IAsyncResult iar, Func2 endFunction, Action1 endAction, Task1 promise, Boolean requiresSynchronization)
2023-09-23T05:36:44Z [Information] OUTPUT: --- End of stack trace from previous location ---
2023-09-23T05:36:44Z [Information] OUTPUT: at Microsoft.SharePoint.Client.ClientRequest.ExecuteQueryToServerAsync(ChunkStringBuilder sb)
2023-09-23T05:36:44Z [Information] OUTPUT: at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
2023-09-23T05:36:44Z [Information] OUTPUT: at Microsoft.SharePoint.Client.ClientRequest.ExecuteQueryAsync()
2023-09-23T05:36:44Z [Information] OUTPUT: at Microsoft.SharePoint.Client.ClientRuntimeContext.ExecuteQueryAsync()
2023-09-23T05:36:44Z [Information] OUTPUT: at Microsoft.SharePoint.Client.ClientContext.ExecuteQueryAsync()
2023-09-23T05:36:44Z [Information] OUTPUT: at Microsoft.SharePoint.Client.ClientContextExtensions.ExecuteQueryImplementation(ClientRuntimeContext clientContext, Int32 retryCount, String userAgent)
2023-09-23T05:36:44Z [Information] OUTPUT: at Microsoft.SharePoint.Client.ClientContextExtensions.ExecuteQueryImplementation(ClientRuntimeContext clientContext, Int32 retryCount, String userAgent)
2023-09-23T05:36:44Z [Information] OUTPUT: at Microsoft.SharePoint.Client.ClientContextExtensions.ExecuteQueryRetry(ClientRuntimeContext clientContext, Int32 retryCount, String userAgent)
2023-09-23T05:36:44Z [Information] OUTPUT: at PnP.PowerShell.Commands.Base.PnPAdminCmdlet.BeginProcessing() in D:\a\powershell\powershell\src\Commands\Base\PnPAdminCmdlet.cs:line 116
2023-09-23T05:36:44Z [Information] OUTPUT: at Microsoft.SharePoint.Client.SPWebRequestExecutor.ExecuteAsync()
2023-09-23T05:36:44Z [Information] OUTPUT: Source : PnP.PowerShell
2023-09-23T05:36:44Z [Information] OUTPUT: HResult : -2146233079
2023-09-23T05:36:44Z [Information] OUTPUT: StackTrace :
2023-09-23T05:36:44Z [Information] OUTPUT: at PnP.PowerShell.Commands.Base.PnPConnection.CloneContext(String url) in D:\a\powershell\powershell\src\Commands\Base\PnPConnection.cs:line 737
2023-09-23T05:36:44Z [Information] OUTPUT: at System.Management.Automation.CommandProcessorBase.DoBegin()
2023-09-23T05:36:44Z [Information] OUTPUT: at System.Management.Automation.Cmdlet.DoBeginProcessing()
2023-09-23T05:36:44Z [Information] OUTPUT: CategoryInfo : InvalidOperation: (:) [Get-PnPTenantSite], PSInvalidOperationException
2023-09-23T05:36:44Z [Information] OUTPUT: FullyQualifiedErrorId : InvalidOperation,PnP.PowerShell.Commands.GetTenantSite
2023-09-23T05:36:44Z [Information] OUTPUT: at PnP.PowerShell.Commands.Base.PnPAdminCmdlet.BeginProcessing() in D:\a\powershell\powershell\src\Commands\Base\PnPAdminCmdlet.cs:line 124
2023-09-23T05:36:44Z [Information] OUTPUT: MyCommand : Get-PnPTenantSite
2023-09-23T05:36:44Z [Information] OUTPUT: OffsetInLine : 9
2023-09-23T05:36:44Z [Information] OUTPUT: InvocationInfo :
2023-09-23T05:36:44Z [Information] OUTPUT: ScriptName : C:\home\site\wwwroot\TeamSiteProvisioning\run.ps1
2023-09-23T05:36:44Z [Information] OUTPUT: HistoryId : 1
2023-09-23T05:36:44Z [Information] OUTPUT: Line : $Site = Get-PnPTenantSite -Identity $webUrl -Connection $webConnect
2023-09-23T05:36:44Z [Information] OUTPUT:
2023-09-23T05:36:44Z [Information] OUTPUT: PositionMessage : At C:\home\site\wwwroot\TeamSiteProvisioning\run.ps1:43 char:9
2023-09-23T05:36:44Z [Information] OUTPUT: + $Site = Get-PnPTenantSite -Identity $webUrl -Connection $webConnect
2023-09-23T05:36:44Z [Information] OUTPUT: + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~