[BUG]Set-PnPGroup: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

[ptrosek]

Problem

When running Set-PnPGroup -Identity "Name_of_the_group" -SetAssociatedGroup Owners
I encounter Set-PnPGroup: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

Problem already encounterd and not solved on:
#699
pnp/PnP-PowerShell#3013

Steps to reproduce behavior

1. Created new group with custom permission level

2. After connecting i tried to run this on an account with Global Administrator, Admin and Owner of the site:
   Set-PnPGroup -Identity "Name_of_the_group" -SetAssociatedGroup Owners

What is the version of the Cmdlet module you are running?

PnP 2.4.0
Powershell 7.4.1

Which operating system/environment are you running PnP PowerShell on?

• Windows
• Linux
• MacOS
• Azure Cloud Shell
• Azure Functions
• Other : please specify

[marcvall]

We face the same issue if Custom Scripts are Blocked for the site collection. We can set group permissions with Set-PnPGroupPermissions, but we cannot set associated groups with Set-PnPGroup -Identity "ABC" -SetAssociatedGroup Members

Is this expected behaviour?

[Jherschel7]

I am getting the same error the past few days and found this post.

[eshartwell]

This was working fine for 8 months and suddenly stopped working on 6/17.

[eshartwell]

I figured it out today after I recalled a change Microsoft instituted recently. All site collections automatically have the setting forced back to $true for security reasons (-DenyAddCustomizePages). This seems to prevent Set-PnPGroup from working correctly in our Azure Automation. Once I used this command on the site collection it worked without issue:
Set-PnPTenantSite -Identity "yoursitecollection" -DenyAddAndCustomizePages:$false

[marcvall]

Did they say if this is expected? I mean, without setting DenyAddAndCustomizePages:$false we CAN set group permissions, but we CANNOT set associated groups. Doesn't make sense to me...

We'd like to avoid setting this property every time we need to change associated groups (MS will rollback the property every 24h)...

[eshartwell]

It does seem odd to me as well - but I agree with the increased security stance. There is a command to force this setting to stay persistently until November 2024, but it only delays this same issue (Set-SPOTenant -DelayDenyAddAndCustomizePagesEnforcement $True). For now, I've decided to run a batch in Azure Automation every 24 hours for the few site collections that we've automated to ensure we don't hit this issue again.

[rockraider213]

same here in azure runbook:
Powershell 7.2
PnP.Powershell 2.12.0

i am not getting this error locally:
Powershell 7.4.5
pnp.powershell 2.12.0