[BUG] Set-PnPUserProfileProperty : Access denied. You do not have permission to perform

[thuld]

Please see also related discussion Can Get nut can't Set with pnp.powershell

Expected behavior

Cmdlet Set-PnPUserProfileProperty allows to update of user-profile properties

Actual behavior

Error is raised:

Set-PnPUserProfileProperty : Access denied. You do not have permission to perform this action or access this resource.
At line:1 char:1
+ Set-PnPUserProfileProperty -Account 'test@foobar.com ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : WriteError: (:) [Set-PnPUserProfileProperty], ServerUnauthorizedAccessException
    + FullyQualifiedErrorId : EXCEPTION,PnP.PowerShell.Commands.UserProfiles.SetUserProfileProperty

Steps to reproduce behavior

1. Connect SharePoint Online
2. Run following code: Set-PnPUserProfileProperty -Account 'test@foobar.com' -PropertyName 'WorkPhone' -Value '0123456789'

What is the version of the Cmdlet module you are running?

Manifest 1.3.0 PnP.PowerShell {Add-PnPAlert, Add-PnPApp, Add-PnPApplicationCustomizer, Add-PnPContentType...}

Which operating system/environment are you running PnP PowerShell on?

• Windows
• Linux
• MacOS
• Azure Cloud Shell
• Azure Functions
• Other : please specify

[BaronSparky]

How did you connect to SPO? i.e. which switch on the "Connect-PnPOnline"?

I have noticed a similar issue this morning, i.e. "Access denied." when using the "-UseWebLogin" or "-Interactive" arguments. However, when I connected via "-Credentials" on the "Connect-PnPOnline", it worked.

Perhaps the issue is with the Connect-PnPOnline cmdlet.

[erwinvanhunen]

The issue is most likely connected to the registration of the PnP Management Shell application that is in place in your Azure AD. Run Register-PnPManagementShellApplication again, it will change the granted permissions: we added the userprofile readwrite right there like 2 weeks ago (it used to be only read access).

[thuld]

I am using the following approach to connect to SharePoint Online:

Connect-PnPOnline -Url 'https://foobar4com-admin.sharepoint.com' -Interactive

@erwinvanhunen We registered the application yesterday and the permissions of this application seems ok:

Update: I have now executed Register-PnPManagementShellAccess and then created a new connection, but the error is the same.

[BaronSparky]

The same for me also...

[erwinvanhunen]

I just tested and indeed it doesn't work with a bearer token (which is what we use by default). It seems that that is not (more?) supported. We'll investigate that. I noticed that if you use -UseWebLogin (which is cookie based auth) it does work.

I'll leave this issue open while we investigate.

[github-actions]

This issue is stale because it has been open 14 days with no activity. Remove stale label or comment or this will be closed in 5 days

[Geo-Ron]

@erwinvanhunen Is there any progress on this?

[SebasT87]

Same problem here, hoping for a quick fix.
As a workaround i did a rollback to the former SharepointPnP.

[barkerboy8]

I'm having the same issue - when will this be fixed?

[Markarend]

Here are a couple of possible clues, though I still get the same error behavior discussed in this issue.

Accessing SharePoint using an application context, also known as app-only says "User Profile CSOM write operations do not work with Azure AD application - read operations work. Both read and write operations work through SharePoint App-Only principal". Then Granting access using SharePoint App-Only gives instructions for setting that up. I was feeling pretty good when I found this, but then when I tested, still "Access denied. You do not have permission to perform this action or access this resource. Microsoft.SharePoint.Client.ServerUnauthorizedAccessException, ServerErrorCode : -2147024891, ServerErrorTypeName : System.UnauthorizedAccessException".

Another possible clue is that Granting access using SharePoint App-Only shows -AppId and -AppSecret parameters for Connect-PnPOnline, but the current version (1.3.0?) doesn't provide those parameters, only -ClientId and -ClientSecret.

Is there a PnP core version I can test with that provides -AppId and -AppSecret?

[Markarend]

@SebasT87 what version of SharePointPnP are you using as a workaround?