[BUG] Remove-PnPDeletedMicrosoft365Group insufficient privileges error even though I am the owner with Group.ReadWrite.All permission

[kbeeveer46]

Reporting an Issue or Missing Feature

EDIT: A comment on this Stack Overflow post says that app registrations cannot permanently delete objects. If that's the case, I think it would be helpful if that was mentioned in the cmdlet documentation https://stackoverflow.com/questions/74959445/how-to-delete-a-group-permanently

I am able to run Remove-PnPMicrosoft365Group but when I run Remove-PnPDeletedMicrosoft365Group to delete it from the deleted groups list I get "Insufficient privileges to complete the operation". Both of these cmdlets require the same permission according to the documentation. Why does one work and not the other? Does Remove-PnPDeletedMicrosoft365Group require more permission?

I am using a service principal with the following permissions and the service principal is an owner of the group. My cmdlets are in an Azure Function running PnP v2.1.1

• Group.ReadWrite.All
• RoleManagement.ReadWrite.Directory
• Application.Read.All

Expected behavior

I expect the group to be deleted from the deleted groups list.

Actual behavior

2024-03-08 23:58:21.264 Executing 'Functions.siteDelete' (Reason='This function was programmatically called via the host APIs.', Id=8f0a773d-4c5c-4bf0-85a1-f71789fb4487)

2024-03-08 23:58:43.005 OUTPUT: >>> Deleting ClientPortalMDP55738HOME Group

2024-03-08 23:58:43.157 OUTPUT: >>> Recycling ClientPortalMDP55738HOME Group

2024-03-08 23:58:43.387 OUTPUT: >>> Error: Insufficient privileges to complete the operation.

2024-03-08 23:58:43.392 Executed 'Functions.siteDelete' (Succeeded, Id=8f0a773d-4c5c-4bf0-85a1-f71789fb4487, Duration=22130ms)

Steps to reproduce behavior

 $clientName = $Request.Body.ClientName.Replace(' ', '')

 Connect-PnPOnline -Url "https://XXXXX-admin.sharepoint.com" -ManagedIdentity

 $group = Get-PnPMicrosoft365Group | Where-Object Mail -eq "ClientPortal$($clientName)HOME@XXXXXX.onmicrosoft.com"

    if ($group.Id)
    {
        Write-Output ">>> Deleting ClientPortal$($clientName)HOME Group"

        Remove-PnPMicrosoft365Group -Identity $group

        Write-Output ">>> Recycling ClientPortal$($clientName)HOME Group"

        Remove-PnPDeletedMicrosoft365Group -Identity $group  *******THIS LINE DOESN'T WORK*******
    }

What is the version of the Cmdlet module you are running?

2.1.1

Which operating system/environment are you running PnP PowerShell on?

• Windows
• Linux
• MacOS
• Azure Cloud Shell
• Azure Functions
• Other : please specify