Huge list of permissions required in PNP Management Powershell

[stuart-drysdale]

Hi
there seems to be way more permission than we would like to apply in our tenant when all we are trying to achieve is grant permissions to a user to use SP credentials to connect to a site collection and perform functions with file, folders, lists, permissions etc. They don't need all the rest.

How do we restrict this?

Thanks

Stuart

[ToddKlindt]

The PnP Azure Application uses delegation so a user that uses it can only leverage permissions to objects and permissions they already have access to. Using the PnP does not give a user and way to do anything they couldn't do without the PnP. This article explains it a little.
To recap, a user that authenticates with PnP will only be able to do what they have explicitly been given permission to.

[stuart-drysdale]

Thanks Todd,

That makes it easier to explain to Security to get it setup.

[ToddKlindt]

Don't take my word for it, test it for yourself. Authenticate with Connect-PnPOnline and try to do something that user doesn't have permission to do. Try to connect to a site collection the user doesn't have access to in a browser, something like that. They won't be able to.

[stuart-drysdale]

I did, and it works perfectly. Again thank you. I just needed to explain to security why all these permissions were required, and you answered perfectly