Non-functional control of MS Teams using PNP.

[MilanVolf]

Notice

Sometime after October, when I ran the script for the last time, MS Teams and PNP administration stopped working. When I log in using Connect-PnPOnline and using the "AccessToken" or "CertificatePath" certificate, I cannot use the commands related to controlling MS Teams. i always get the error: "UnknownError"

If I log in manually using PnPOnline and perhaps "DeviceLogin", the commands for MS Teams administration work as before. Unfortunately, this style of administration cannot be automated, as the admin always has to enter login information.

Other than that, there was no change in my environment, both in the configuration of the MS environment and the change in the script.

Thank you for your help.

Reporting an Issue or Missing Feature

Issue
I don't know if this is a bug or a major change.

Expected behavior

Token or certificate credentials to work again for the MS Teams service.

Actual behavior

Please describe what you see instead. Please provide samples of output or screenshots.

Steps to reproduce behavior

ERROR:

Connect-PnPOnline -Url "https://xxxxxxxx-admin.sharepoint.com/" -AccessToken $token
Get-PnPTeamsTeam

Get-PnPTeamsTeam : UnknownError
At line:1 char:1
+ Get-PnPTeamsTeam
+ ~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Get-PnPTeamsTeam], PSInvalidOperationException
    + FullyQualifiedErrorId : InvalidOperation,PnP.PowerShell.Commands.Graph.GetTeamsTeam

During testing I got this error once:
Get-PnPTeamsTeam : Failed to execute backend request.

Functional demo:

Connect-PnPOnline -Url "https://xxxxxxxx-admin.sharepoint.com/" -DeviceLogin
Get-PnPTeamsTeam

GroupId                              DisplayName      Visibility       IsArchived MailNickname
-------                              -----------      ----------       ---------- ------------
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx ZS 1011          HiddenMembership True       ZS1011
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx ZS 1012          HiddenMembership True       ZS1012

What is the version of the Cmdlet module you are running?

1.12.0 and 1.11.0

Which operating system/environment are you running PnP PowerShell on?

• Windows

[Studermarc]

Hi @MilanVolf ,

Did you double check the permissions of the App you are using for unattended login?
-> it could be related to missing Graph permissions.

Did you try connecting whilst retrieving the Connection Object with -returnconnection switch? You then need to reference this object on every PNP cmdlet you execute with the -connection parameter.
-> It could be related to conflicts with connections. There has been some rework in that area in the past months.

[MilanVolf]

Hi @Studermarc,

According to the documentation, the application has the necessary permissions set:
Group.Read.All
Group.ReadWrite.All

For routine: Get-PnPTeamsTeam
https://pnp.github.io/powershell/cmdlets/Get-PnPTeamsTeam.html

AAD Portal:

-returnconnection and -connection
I tested today. Connection works for me with this, but unfortunately MS teams is broken.
The error is still the same:

Get-PnPTeamsTeam -Connection $Connection
Get-PnPTeamsTeam : UnknownError
At line:1 char:1
+ Get-PnPTeamsTeam -Connection $Connection
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Get-PnPTeamsTeam], PSInvalidOperationException
    + FullyQualifiedErrorId : InvalidOperation,PnP.PowerShell.Commands.Graph.GetTeamsTeam

Get-PnPTeamsTeam -Connection $Connection
Get-PnPTeamsTeam : Failed to execute backend request.
At line:1 char:1
+ Get-PnPTeamsTeam -Connection $Connection
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Get-PnPTeamsTeam], PSInvalidOperationException
    + FullyQualifiedErrorId : InvalidOperation,PnP.PowerShell.Commands.Graph.GetTeamsTeam

For example, the command:
Get-PnPList
It works without a problem.

Get-PnPList -Connection $Connection

Title                                                                 Id                                   Url
-----                                                                 --                                   ---
appdata                                                               xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx /_catalogs/appdata
appfiles                                                              xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx /_catalogs/appfiles
DO_NOT_DELETE_SPLIST_TENANTADMIN_AGGREGATED_CONTENTTYPES              xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx /Lists/DO_NOT_DELETE_SPLIST_TENANTADMIN_AGGREGATED_CONTEN 

Thanks for the tip, can't think of anything else why the Teams PnP Routine doesn't work through the app?

Thank you.

[Studermarc]

How are you connecting exactly? Still looks like a token issue for me.

[MilanVolf]

Today I tested everything through the certificate uploaded in the application.

This is how I connect:

$cert = get-content "C:\Scripts\cert.pfx" -Encoding Byte
$base64 = [System.Convert]::ToBase64String($cert)
$password = (ConvertTo-SecureString -AsPlainText "main_passwd" -Force)
$Connection = Connect-PnPOnline -Url "https://xxxxxxxxxx-admin.sharepoint.com/" -ClientId "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -CertificateBase64Encoded $base64 -CertificatePassword $password -Tenant "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -ReturnConnection

I am testing these commands:
Get-PnPList -Connection $Connection
This one works.

Get-PnPTeamsTeam -Connection $Connection
This one doesn't work.

Disconnect:
$Connection = $null

[MilanVolf]

Hello @Studermarc
Can't you think of a reason?

Thank you for your help.

[gautamdsheth]

hi @MilanVolf , am moving this to a discussion.
Seems like some issue with the AccessToken that you are providing.
Since it works with -DeviceLogin cmdlet , then we can safely say that the cmdlet itself is working as expected and there's no issue with the module.

Please try @Studermarc 's suggestions as well .

[MilanVolf]

Hi @gautamdsheth,

Please revert back to Issues.
Logging in with -DeviceLogin does work, but note that I have to log in the device interactively, but under my account. Which my account is Global Administrator.
When I log in using an -AccessToken, I log in through the permissions set for the application in the AAD portal.

In terms of permissions, it's completely different.

As I wrote above. The authorization according to the documentation is set correctly. Everything was working fine until September of this year. After that, there was apparently an adjustment somewhere on Microsoft's side. Subsequently, the script stopped working for me via PnP. (Graph API)

Nothing has changed for me. For testing, I set my application, through which I connect with Powershell, really high permissions. Unfortunately it still doesn't work.

Thank you.

[MilanVolf]

Hi @gautamdsheth,

Please revert back to Issues.
Logging in with -DeviceLogin does work, but note that I have to log in the device interactively, but under my account. Which my account is Global Administrator.
When I log in using an -AccessToken, I log in through the permissions set for the application in the AAD portal.

In terms of permissions, it's completely different.

As I wrote above. The authorization according to the documentation is set correctly. Everything was working fine until September of this year. After that, there was apparently an adjustment somewhere on Microsoft's side. Subsequently, the script stopped working for me via PnP. (Graph API)

Nothing has changed for me. For testing, I set my application, through which I connect with Powershell, really high permissions. Unfortunately it still doesn't work.

Thank you.