Cli-microsoft365: Add 'spo personalsite add' command

[Laskewitz]

Hi,

I would love to see the new-pnppersonalsite cmdlet ported to the office365-cli. @waldekmastykarz is this the right naming?

Cheers,
Daniel

[waldekmastykarz]

Absolutely! Want to propose a spec @Laskewitz?

[waldekmastykarz]

Creates personal site for the specified users

spo personalsite add -e|--emails <emails>

• emails: Comma-separated list of e-mail addresses of users for whom to create a personal site

Equivalent of the New-PnPPersonalSite PowerShell cmdlet

[garrytrinder]

Hey @waldekmastykarz I don't mind picking this up 👍🏻

[garrytrinder]

Done some digging into this, no REST endpoint for this, but caught this XML payload in a Fiddler trace whilst executing the New-PnPPersonalSite cmdlet so can pass this to Client.svc

<Request AddExpandoFieldTypeSuffix="true" 
  SchemaVersion="15.0.0.0" 
  LibraryVersion="16.0.0.0" 
  ApplicationName="SharePoint PnP PowerShell Library" 
  xmlns="http://schemas.microsoft.com/sharepoint/clientquery/2009">
  <Actions>
    <ObjectPath Id="5" 
      ObjectPathId="4" />
    <Method Name="CreatePersonalSiteEnqueueBulk" 
      Id="6" 
      ObjectPathId="4">
      <Parameters>
        <Parameter Type="Array">
          <Object Type="String">[email protected]</Object>
          <Object Type="String">[email protected]</Object>
        </Parameter>
      </Parameters>
    </Method>
  </Actions>
  <ObjectPaths>
    <StaticMethod Id="4" 
      Name="GetProfileLoader" 
      TypeId="{9c42543a-91b3-4902-b2fe-14ccdefb6e2b}" />
  </ObjectPaths>
</Request>

[waldekmastykarz]

Awesome! Yeah, for some commands there is no REST API in SharePoint and we need to basically mimic CSOM call.

[garrytrinder]

I've been working on this tonight and stumbled across a permissions issue as I am getting Error: Access denied. You do not have permission to perform this action or access this resource. response from the request when authenticated as Global Administrator.

I assume that as the Client.svc request mimics the ProfileLoader.CreatePersonalSiteEnqueueBulk() method, the CLI will require User.ReadWrite.All permissions rather than User.Read.All which it is currently given.

@waldekmastykarz any guidance on what I should do here? Is it possible to point the CLI to use my own app identity with the User.ReadWrite.All permission granted?

[garrytrinder]

I managed to work out how to point to my own app identity after reading through the docs. Who would have thought documentation could be so useful... 😄

Anyway, I tried using my own identity with User.ReadWrite.All permissions granted and I'm still getting the same error 🤔 Any ideas?

[garrytrinder]

A quick google has found this, so it looks like it might be a licensing issue with the users I’m using in my testing, rather than a permissions issue.

https://sharepoint.stackexchange.com/questions/234993/access-denied-on-a-createpersonalsiteenqueuebulk-request-by-global-admin

[waldekmastykarz]

Great to see that you were able to unblock yourself using the docs 😄 It would be helpful if you could verify that it's indeed a licensing issue rather than something in the code that would prevent us from implementing it. Appreciate your help 👏

[garrytrinder]

I plan on setting up a new demo tenant to test the license theory against, so this is still work in progress.

[garrytrinder]

I've created a new tenant, assigned a user an E5 licence, but still getting Access Denied error thrown, that is also when granted User.ReadWrite.All using a custom app identity. It must be something else... 🤔

[garrytrinder]

@waldekmastykarz looks like I've stumbled across an issue in the API, see referenced issue above.

[waldekmastykarz]

Nice find! How is this solved in PnP PowerShell? Do they have the same issue?

[garrytrinder]

I’ll do some more digging over the weekend but as far as I know PnP-PowerShell uses a single CSOM call using the Tenant Admin URL.

I’ll inspect the request in more detail, see I’m missing a header somewhere.

[garrytrinder]

I've tested the New-PnPPersonalSite cmdlet and found that when using Forms Authentication (Get-Credentials) the cmdlet works as expected, however when using an App Identity (Bearer Token) I get the same error.

[garrytrinder]

I have raised this as an issue in PnP PowerShell repo https://github.com/SharePoint/PnP-PowerShell/issues/2267

@waldekmastykarz I think it would be best to put this on hold for now, looks like an API issue to me.

[waldekmastykarz]

Thank you for all the research around it 👏

[waldekmastykarz]

Since this is still not supported in the API, shall we close this issue for now and re-open should anything change?

[garrytrinder]

We can close it, that's not a problem.

I have the branch saved on my fork for when (if) it is supported.