Connect-PnPOnline: Access denied/unauthorized operation

Question

I am simply trying to manage an existing site by adding/removing folders and files, nothing special. I am new to the App Registration approach, but I read through lots of documentation and in the end I always see the requirement of having Sites.FullControl.All permissions to manage sites. Is that true?

What I'm trying to do:

1. Connect to a site
2. Create/Change/Delete Folders and/or files
3. grant permissions to that folders

So, nothing special at all. My code looks like:

Connect-PnPOnline "https://TenantName.sharepoint.com/MySiteName" -ClientId "MyClientID" -Tenant TenantName.onmicrosoft.com -Thumbprint "CertThumbprint -verbose

Get-PnPSite

My Output is like

The assigned rights to my Application are:

I am working in a bigger enterprise, thats why the set of applied permissions is limited to the ones in the figure above. Full Control wont get an admin consent. My current User is not able to sign in with MFA, only with certificate. Some help or guidance would be appreciated.

Answer 1

Hi @von Lachner, Matthias ,

Thank you for posting in this community.

To perform actions such as connecting to a site, creating/changing/deleting folders and files, and granting permissions, the Sites.FullControl.All permission is indeed required. This permission allows your application to have full control over all SharePoint sites and lists.

In order to be able to access any target site, you'll need a tenant global admin or an application with Sites.FullControl.All application permission to grant explicit permissions for the selected target sites.

The issue you're facing with admin consent is common in large enterprises. Without admin consent, your app won't be able to obtain these higher-level permissions, especially the Sites.FullControl.All permission. If admin consent isn't available, you might need to work with your admin team to get this permission granted to your application.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.