Get-PnPTenantSite : Attempted to perform an unauthorized operation when using Azure Automation account with Managed Identity

[b3n899]

Hello all,

I try to retrieve all my sharepoint sites with permissions from an azure automation account powershell script using managed identity.
If I'm running the command on a specific site it's working fine.

My managed identity has Microsoft Graph and Sharepoint online sites.fullcontrol.all permissions.

Here is the script that I'm trying to use:

#Parameters

$SiteURL = "https://mytenant-admin.sharepoint.com"

#Connect to SharePoint Online
Connect-PnPOnline -Url $SiteURL -ManagedIdentity

#Get all sites in the SharePoint tenant
$Sites = Get-PnPTenantSite

#Array to store site information
$SiteData = @()

#Loop through each site and extract information
ForEach ($Site in $Sites)
{
#Get the web
$Web = Get-PnPWeb -Identity $Site.Url -Includes RoleAssignments

#Loop through each permission assigned and extract details
$PermissionData = @()

#Get SharePoint groups
$Groups = Get-PnPGroup

ForEach ($RoleAssignment in $Web.RoleAssignments)
{
    #Get the Permission Levels assigned and Member
    Get-PnPProperty -ClientObject $RoleAssignment -Property RoleDefinitionBindings, Member

    #Get the Permission Levels assigned
    $PermissionLevels = ($RoleAssignment.RoleDefinitionBindings | Select -ExpandProperty Name | Where {$_ -ne "Limited Access"}) -join ","
    $PermissionType = $RoleAssignment.Member.PrincipalType

    #Leave Principals with no Permissions
    If ($PermissionLevels.Length -eq 0) {Continue}

    #Collect Permission Data
    $Permissions = New-Object PSObject
    $Permissions | Add-Member NoteProperty Name ($RoleAssignment.Member.Title)
    $Permissions | Add-Member NoteProperty Type ($PermissionType)
    $Permissions | Add-Member NoteProperty PermissionLevels ($PermissionLevels)
    $Permissions | Add-Member NoteProperty SiteName ($Web.Title)
    $PermissionData += $Permissions
}

#Loop through SharePoint groups to get group members
ForEach ($Group in $Groups)
{
    $GroupMembers = Get-PnPGroup -Identity $Group.Title | Select-Object -ExpandProperty Users

    ForEach ($Member in $GroupMembers)
    {
        $GroupPermission = New-Object PSObject
        $GroupPermission | Add-Member NoteProperty Name ($Member.Title)
        $GroupPermission | Add-Member NoteProperty Type ($Group.Title)
        $GroupPermission | Add-Member NoteProperty PermissionLevels ($Group.Roles)
        $GroupPermission | Add-Member NoteProperty SiteName ($Web.Title)
        $PermissionData += $GroupPermission
    }
}

#Add site data to the array
$SiteInfo = New-Object PSObject
$SiteInfo | Add-Member NoteProperty SiteURL ($Site.Url)
$SiteInfo | Add-Member NoteProperty Permissions ($PermissionData)
$SiteData += $SiteInfo

}

#Export the mailbox and permission information to a CSV file
$SiteData | Export-Csv -Path "SPOlist.csv" -NoTypeInformation

#Disconnect from SharePoint Online
Disconnect-PnPOnline

In addition, If I simply run the command Get-PnPTenantSite it gives me the output and If I close the test pane and run the test again I get the "Attempted to perform an unauthorized operation" it looks like it can't handle multiple queries or something similar.

Thanks for your help

[joostvdlinden]

Hi @b3n899 I experience the same issue.
Have you been able to resolve this issue in the meantime?

[dlxpbva]

Hi @b3n899 , same problem here. I'm running a runbook in Azure Automation and connect to PnP using Managed Identity.

Get-PnPTenantSite was working fine for me for a couple of weeks an today I also got "Attempted to perform an unauthorized operation." error.

Did you find any solution?

[CLiX-1]

It seems to be a general issue. I also get "Attempted to perform an unauthorized operation." with Get-PnPTenantSite or Get-PnPUserProfileProperty since May 19th.

[CLiX-1]

In my case, I had to change the Sharepoint API permission from Sites.Selected (with write permission on die https://-admin.sharepoint.com site) to Sites.FullControl.All.
With this permission, Get-PnPTenantSite and Get-PnPUserProfileProperty works again.

[dlxpbva]

Hi @CLiX-1, did the same, removed Sites.Selected and added Sites.FullControll.All, that fixed the problem. Thanks!

[faisaleem-na]

hi,
sorry new to this topic but experiencing the same issue. can you describe in more detail what permissions you gave in order to get it to work. as in the commands you ran against which url, would be greatly appreciated
thanks