Get-PnPWeb -Includes RoleAssignments - Access denied

[MP03online]

I was using the legacy PnP Powershell (SharePointPnPPowerShellOnline) and my code has always worked, but when using the new cross-platform Pnp Powershell (PnP.PowerShell), the following code does not allow me to access the RoleAssigments property in the current web.

$web = Get-PnPWeb -Includes RoleAssignments
Get-PnPWeb : Access denied. You do not have permission to perform this action or access this resource.
At line:1 char:8

• $web = Get-PnPWeb -Includes RoleAssignments

•    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : WriteError: (:) [Get-PnPWeb], ServerUnauthorizedAccessException
  • FullyQualifiedErrorId : EXCEPTION,PnP.PowerShell.Commands.GetWeb

I also tried getting the current web without the roleassignments property (which worked) then attempting.
$roleAssignments = Get-PnPProperty -Property RoleAssignments -ClientObject $web
Get-PnPProperty : Access denied. You do not have permission to perform this action or access this resource.
At line:1 char:20

• ... signments = Get-PnPProperty -Property RoleAssignments -ClientObject $ ...

•             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : WriteError: (:) [Get-PnPProperty], ServerUnauthorizedAccessException
  • FullyQualifiedErrorId : EXCEPTION,PnP.PowerShell.Commands.Base.EnsureProperty

[pmcopeland]

I'm also encountering this issue, but only on a GCC tenant. The only work around I've found so far is to connect to PnP using the PnP Management Shell Multi-Tenant Azure AD Application, but that would require opening up a lot of access to PnP that I would like to avoid.

Does anyone know the exact API permission that is required to query role assignments? Running Get-PnPWeb without "-Includes RoleAssignments" does not throw an error.

[pmcopeland]

Found the answer based on @rakheshster's somewhat-related post a few days ago. Enabling the Sites.FullControl.All application permission and AllSites.FullControl delegated permission allowed for the role assignments to be queried.

[AndersRask]

Management shell does not give any permissions. They are all delegate permissions, not application permissions Kind regards Anders Rask On 1 Jul 2021 19.58, pmcopeland ***@***.***> wrote: I'm also encountering this issue, but only on a GCC tenant. The only work around I've found so far is to connect to PnP using the PnP Management Shell Multi-Tenant Azure AD Application, but that would require opening up a lot of access to PnP that I would like to avoid. Does anyone know the exact API permission that is required to query role assignments? Running Get-PnPWeb without "-Includes RoleAssignments" does not throw an error. —You are receiving this because you are subscribed to this thread.Reply to this email directly, view it on GitHub, or unsubscribe.