[BUG] Get-PnPFile fails with "File does not exist" after the Entra ID app was removed and I created a local tenant app

[ktlayton]

Notice

Many bugs reported are actually related to the PnP Framework which is used behind the scenes. Consider carefully where to report an issue:

1. Are you using Invoke-PnPSiteTemplate or Get-PnPSiteTemplate? The issue is most likely related to the Provisioning Engine. The Provisioning engine is not located in the PowerShell repo. Please report the issue here: https://github.com/pnp/pnpframework/issues.
2. Is the issue related to the cmdlet itself, its parameters, the syntax, or do you suspect it is the code of the cmdlet that is causing the issue? Then please continue reporting the issue in this repo.
3. If you think that the functionality might be related to the underlying libraries that the cmdlet is calling (We realize that might be difficult to determine), please first double check the code of the cmdlet, which can be found here: https://github.com/pnp/powershell/tree/master/src/Commands. If related to the cmdlet, continue reporting the issue here, otherwise report the issue at https://github.com/pnp/pnpframework/issues

Reporting an Issue or Missing Feature

Please confirm what it is that your reporting
After creating a Tenant app to replace the removed MS Entra ID multi-tenant app the call to Get-PnPFile always fails with "File does not exist error" even when the file does exist. The new app registration has the following permissions consented:

SharePoint:
AllSites.FullControl
AllSites.Manage
AllSites.Read
AllSites.Write
TermStoreReadWrite.All
User.Read.All

Expected behavior

Please describe what output you expect to see from the PnP PowerShell Cmdlets
The expected behavior is the Get-PnPFile will return the stream handle for the file

Actual behavior

Please describe what you see instead. Please provide samples of output or screenshots.
The Get-PnPFile function throws a 404 "File does not exist" error

Steps to reproduce behavior

Please include complete script or code samples in-line or linked from gists

Create new app registration with the permissions outlined above and use the new app for authentication

What is the version of the Cmdlet module you are running?

(you can retrieve this by executing Get-Module -Name "PnP.PowerShell" -ListAvailable)

ModuleType Version Name ExportedCommands

---

Manifest 1.12.0 PnP.PowerShell {Add-PnPAdaptiveScopeProperty, Add-PnPPropertyBagValue, Add-PnPSiteClassification, Copy-PnPFolder...}
Manifest 1.10.0 PnP.PowerShell {Add-PnPAdaptiveScopeProperty, Add-PnPPropertyBagValue, Copy-PnPFolder, Export-PnPClientSidePage...}

Which operating system/environment are you running PnP PowerShell on?

• [X ] Windows
• Linux
• MacOS
• Azure Cloud Shell
• Azure Functions
• Other : please specify

[gautamdsheth]

Can you please update to the latest version 2.12 or the nightly builds , test and let us know ? 1.12 is almost 2 years old and not supported anymore.

[gautamdsheth]

If it is a subsite, you need to connect to that particular subsite in Connect-PnPOnline , not the site collection.

[ktlayton]

It isn't a sub-site, but the script does connect to the site before attempting to get the site label and then the file. The biggest frustration is that the script was working before MS deleted the multi-tenant app and then stopped working for my app even though I have consented to more SharePoint permissions then the MS multi-tenant app had.
I did not all of the Teams permissions that MS app had, do you think that may have something to do with the access denied error?

[gautamdsheth]

Hmm , I would try to debug it this way, if it works , problem would be somewhere else in the script :

Connect-PnPOnline -Url $ServiceURL -Credentials $CredentialId -ClientId $ClientId
Get-PnPFile -Url <server-relative-url-of-your-file>

This doesn't require Teams permissions and others.

This article lists all the permissions that were there earlier, maybe adding Sites.Read.All from Microsoft Graph could help ?

https://pkbullock.com/blog/2024/permissions-for-pnp-management-shell-app

[ktlayton]

@gautamdsheth, I figured out the issue. It turns out that after changing line where the script connected to the specific site, the cut and paste left out the specific site when connecting. I believe this is why the version 1.12 was throwing the "File does not exist error" and why the version 2.12 was throwing the "access denied" error. Once I changed the code to connect to the specific site as it previously did it started working...... feeling rather embarrassed :)

[ktlayton]

I updated to 2.12 and now receive an "access denied" error. This is really frustrating since I have consented to more permissions on my app than what the MS multi-tenant app had and yet with my new app registration when calling Get-PnPFile SharePoint REST service it is giving me an access denied for the same files it worked for before the deprecation of the MS app