I will preface this with saying I have about one year experience with Powershell, I am 24 and junior in the space so don’t be too mean.

Our previous approach was using a service account that was stored in credential manager. This worked well for us as this service account had access to the sites it needed and nothing more. We have sensitive sharepoint sites that only a select few can have access to. We would ideally want to keep this approach or something similar. We are only PS 5.1 and PnP 1.5.

So I’ve seen the changes. We need to do it via app registry in entra. Fine.

I set all that up as per https://pnp.github.io/powershell/articles/registerapplication.html.

Great, progress.

I look at the different authentication methods as per here https://pnp.github.io/powershell/articles/authentication.html

And find

Authenticating with pre-stored credentials using the Windows Credential Manager (Windows only)

Fantastic just what we need. I follow the steps and I get

“Connect-PnPOnline: A configuration issue is preventing authentication – check the error message from the server for details. You can modify the configuration in the application registration portal. See https://aka.ms/msal-net-invalid-client for details. Original exception: AADSTS7000218: The request body must contain the following parameter: ‘client_assertion’ or ‘client_secret’”

Okay let me add the client secret even though the article does not mention it?

Parameter set cannot be resolved using the

| specified named parameters. One or more

| parameters issued cannot be used together or

| an insufficient number of parameters were

| provided.

Right so I cant use -credentials with client secret. Okay remove credentials. It connects Hurrah!

But uh oh. Unauthorised access to the specific site?

Apparently to grant the entra app access I need to use a service principle as per here

https://docs.metallic.io/metallic/create_app_principal_for_sharepoint_online.html

but the permissions are for tenant wide? I just want certain sites. My manager says big no!

I then find this github post straight from PnP https://github.com/pnp/powershell/discussions/4249

Fine let me get onto PS 7 and PnP 2.12. Let me do this

$env:ENTRAID_APP_ID = ‘<Client/Application ID of EntraID app>’

Connect-PnPOnline “https://tenant.sharepoint.com” -Interactive

Nothing happens… ok?

or

$env:ENTRAID_APP_ID = ‘<Client/Application ID of EntraID app>’

Connect-PnPOnline “https://tenant.sharepoint.com” -Credentials (Get-Credentials)

Errors galore, Get Creds not recognised, ok let me specify my creds from cred manager. No, wants client secret.

PLEASE SOMEONE HELP ME

Ideally we can use our service account via credential manager to then connect using the app registry as claimed was possible so we can access and upload to specific sharepoint sites that we want. We don’t want to be giving the app tenant wide permissions even if they are write only.

I have the certificate approach and client secret approach working but the app does not have the necessary permissions to access those sites in sharepoint, which as mentioned would require giving the app permissions in sharepoint.

What am I missing here? Can you really use the credential approach with the app ID? Am I stupid?

I was expecting to be able to connect to sharepoint using the app ID and the credentials as mentioned in the articles I provided