Add-PnPMicrosoft365GroupToSite does not work when connected via App Only

[yurikokaito]

I am trying to groupify an existing classic team site by creating a Microsoft 365 group. Using Add-PnPMicrosoft365GroupToSite returns an error message "Add-PnPMicrosoft365GroupToSite: An error occurred while processing this request." Did anyone have the same issue and solve it? If so, could you please let me know?

Also, following page shows required permission (SharePoint: Access to the SharePoint Tenant Administration site) in order to use Add-PnPMicrosoft365GroupToSite. Where and How to set this permission in API permissions of the Microsoft Azure App registrations?
https://pnp.github.io/powershell/cmdlets/Add-PnPMicrosoft365GroupToSite.html

Here are the commands that I used

Connect-PnPOnline -ClientId [My client ID] -CertificatePath 'C:\xxx\certificate.pfx' -CertificatePassword (ConvertTo-SecureString -AsPlainText "[password]" -Force) -Url https://[My tenant]-admin.sharepoint.com -Tenant "[My tenant].onmicrosoft.com"

Add-PnPMicrosoft365GroupToSite -Url "https://[My tenant].sharepoint.com/teams/test" -Alias "test" -DisplayName "test" -KeepOldHomePage

My Azure API permissions are

I created a certificate by following instruction.
https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread

PowerShell version 7.4.4
PnP.PowerShell version 2.5.0

[khha]

@yurikokaito I have the same problem. Is there some solution? I also using an Azure app registration with certificate

[maeni70]

@yurikokaito @khha The same problem for me as well!

This command works - so, there should not be an issue with API permissions:
New-PnPMicrosoft365Group

The same for New-PnPSite.

The verbose when running Add-PnPMicrosoft365GroupToSite returns following:
"Connected to the SharePoint Online Admin Center at 'https://tenant-admin.sharepoint.com' to run this cmdlet"

And then also the error "An error occurred while processing this request.", which is not really helpful.

The command worked when connecting with a cloud account for authentication (passing the credentials) instead of service principal. But this is not supported anymore.

At the moment the creation of new team sites by our members is prevented. We don't allow direct team site creation in Microsoft 365 (in UI), but have automations in place. So, it is really urgent!

Thanks all for checking...