Azure AD app permissions for getting all sites using PnP Commands

ABHISHEK KUMAR 61 Reputation points
2023-10-04T06:30:21.9933333+00:00

Hi

I am connecting to SharePoint admin center using command "Connect-PnPOnline" with certificate thumbprint and Client Id. In my Azure AD App, I am having the SharePoint Permission "Sites.Read.All". I am trying to get all the site collections from tenant using this PnP command "Get-PnPTenantSite". I am not able to get any data. It is showing me an Unauthorized Operation.

If i am using "Sites.Manage.All" in Azure AD App, I can able to do all operations.

Can you please explain me Why "sites.Read.All" is not enough for getting the site collection Details?
User's image

SharePoint Development
SharePoint Development
SharePoint: A group of Microsoft Products and technologies used for sharing and managing content, knowledge, and applications.Development: The process of researching, productizing, and refining new or existing technologies.
2,783 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,354 questions
0 comments
Accepted answer
  1. Rob Windsor 1,961 Reputation points
    2023-10-04T13:58:00.63+00:00

    I'm not aware of any documentation that shows the permissions required to perform specific operations in the SharePoint APIs so I can only give you my opinion.

    I think of it this way:

    • Read is roughly equivalent to visitor permission
    • Write is roughly equivalent to contributor permission
    • Manage is roughly equivalent to owner permission
    • FullControl roughly equivalent to admin permission

    I say "roughly equivalent" above because I've come across scenarios where I was sure I'd only need Write permission but it turns out I needed Manage or I was sure I would only need Manage but it turns out I needed FullControl. I've found that determining what permissions are required sometimes comes down to trial and error.

    In regards to the Get-PnPTenantSite cmdlet in PnP PowerShell, it is used to connect to the Tenant Administration site so it makes sense to me that Read or Write permission would not be sufficient.

    I hope this helps.

    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Yanli Jiang - MSFT 23,266 Reputation points Microsoft Vendor
    2023-10-05T04:08:08.35+00:00

    Hi @ABHISHEK KUMAR ,

    The "Sites.Read.All" permission in Azure AD App is not enough to get all site collections from the tenant using the PnP command "Get-PnPTenantSite". This is because the "Sites.Read.All" permission only grants the application the ability to read metadata and contents of the site, but not to read the site collections themselves. To get all site collections, you need to use the "Sites.Manage.All" permission or a combination of "Sites.ReadWrite.All" and "Sites.FullControl.All" permissions.

    For your reference:

    Understanding Resource Specific Consent for Microsoft Graph and SharePoint Online

    Getting started with the SharePoint modernization scanner

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.