Access is denied when trying to use Get-PnPUser after successfully connecting using ClientId/Certificate

[cluber22]

I'm trying to get a user from SharePoint Online but am getting the following permissions error:

An error occurred when trying to Get-PnPUser
Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

I can connect fine using the Azure App Registration I created. I also gave that permissions to be able to read all users:

SharePoint (1) -- User.Read.All

Any ideas what I'm doing wrong?

$Domain = "domain"
$SharePoint = "$Domain-admin.sharepoint.com"
$Tenant = "$Domain.onmicrosoft.com"
$ClientId = "xxxxx-yyyyy-zzzzz-aaaaa" # from Azure app registration

Get-PnPConnection

Connect-PnPOnline $SharePoint -ClientId $ClientId -Tenant $Tenant -CertificatePath '.\MyCert.pfx' 

$Users = Get-PnPUser -Identity "John" | Select-Object Email

Disconnect-PnPOnline

Output from Get-PnPConnection:

ConnectionType                             : TenantAdmin
InitializationType                         : Unknown
Scopes                                     :
PSCredential                               :
ClientId                                   : xxxxx-yyyyy-zzzzz-aaaaa
ClientSecret                               : 
ApplicationInsights                        : PnP.PowerShell.ALC.ApplicationInsights
Url                                        : https://domain-admin.sharepoint.com/
TenantAdminUrl                             :
Certificate                                : [Subject]
                                               CN=pnp.contoso.com

                                             [Issuer]
                                               CN=pnp.contoso.com

                                             [Serial Number]
                                               00830EC2A7240B2813

                                             [Not Before]
                                               20/05/2024 00:00:00

                                             [Not After]
                                               20/05/2034 00:00:00

                                             [Thumbprint]
                                               E97001B9107C772A02BBBD706162691372489793

DeleteCertificateFromCacheOnDisconnect     : True
Context                                    : PnP.Framework.PnPClientContext
Tenant                                     : domain.onmicrosoft.com
UserAssignedManagedIdentityObjectId        :
UserAssignedManagedIdentityClientId        :
UserAssignedManagedIdentityAzureResourceId :
AzureEnvironment                           : Production

[Barbarur]

Get-PnPUser retrieves information of a user in aspecific site. So your app needs to have access to at SharePoint API sites.Read

If you want to get the user profile in SharePoint you would need to use Get-PnPUserProfileProperty

[cluber22]

@Barbarur Thanks. Basically I want to get all the users that appear within the SharePoint admin section - User Profiles

[Barbarur]

What about getting all users directly from Azure AD? Any specific needs for getting users directly from SharePoint?

[cluber22]

I think you are right, I think I just need to filter down the Azure AD (Entra ID) list so that it replicates the users I am looking for that is transferred to SharePoint. As I am only looking to bring back users who appear on the SharePoint person search, I should be able to find that query from there.

Thanks again

[cluber22]

Using Azure AD seems best solution rather than SharePoint