PnP-PowerShell Connect-PnPOnline using AppId gives Access denied

[Travis Lingenfelder]

I'm creating a PowerShell script to connect to SharePoint Online and authenticate as a registered Azure AD application (not a user).  In Azure AD I have registered the application and I have the AppId and AppSecret.  Through Azure AD I have granted the application API access to the SharePoint Online API with the application permissions 'Have full control of all site collections' and 'Read and write managed metadata'.  I have also performed admin consent for the app by going to the URL: https://login.microsoftonline.com/<tenant>.onmicrosoft.com/oauth2/authorize?client_id=<client id>&response_type=code&prompt=admin_consent.

When I use the cmdlet: Connect-PnPOnline -Url $siteUrl -AppId $appId -AppSecret $appSecret no message is displayed as if the connection occurs properly.  However, when I use ANY cmdlet (i.e. Get-PnPWeb) I receive 'Access denied. You do not have permission to perform this action or access this resource.'

Any help is appreciated.

[#2]

I believe that "app only" access is not possible for SharePoint Online unless your app secret uses a certificate or the app registered in Azure AD is for a SharePoint Add-In (and the add-in's app principal has been granted app-only access when the add-in was registered in SharePoint Online).

[#3]

Facing the same issue. I have registered an app in AAD with access given to Graph API (to perform B2B external invitation operation) and SPO API (full control to all site collections) but when I use Connect-PnPOnline then it always gives me access denied.

Any solution? Or do I need to register an app separately for SPO?

[#4 · Accepted solution]

I finally figured this out. The Connect-PnPOnline cmdlet is flexible and has multiple ways to connect to SharePoint. They key is using the right set of parameters.  

Using the syntax "Connect-PnPOnline -Url $siteUrl -AppId $appId -AppSecret $appSecret" connects using SharePoint App-only permissions as described here. Using this method you need to register the app using SharePoint (not the graph).  If you want to connect using the Microsoft Graph and Azure AD the connection string would be something like "Connect-PnPOnline -AppId $appid -AppSecret $appsecret -Url $siteUrl -Scopes Sites.FullControl.All".

[#5]

Thanks. But when I use Scopes parameter it is asking to provide the credentials (pop up dialog) even though I am passing AppID and AppSecret.

[#6]

@Travis Lingenfelder 

All you need is:

• connect using an registered app azure ID
• grant that registered app the required access based on your goal
• add that app Id to the sharepoint tenant wide, or to single page

After that, you will be able to connect withou prompt and leverage all pnp-powershell cmdlets.

Here  is a detailed explanation