Pnp-powershell: Get-PnPUnifiedGroup.SiteUrl returns "The caller is not authenticated"

[AmonHouston]

Reporting an Issue or Missing Feature

When I try to get the SharePoint site URL of an Office 365 group, I receive an error message "The caller is not authenticated"

Expected behavior

The Office 365 Group Site URL returned example: https://example.sharepoint.com/sites/examplegroup

Actual behavior

Returns 'The caller is not authenticated.' log

Steps to reproduce behavior

$groupName = "TheExampleGroup"
Connect-PnPOnline "https://example-admin.sharepoint.com" -Credentials 'ExampleCreds'

$O365Group = Get-PnPUnifiedGroup -Identity $groupName

$siteUrl = $O365Group.SiteUrl

Write-Host $siteUrl

Logs out:
The caller is not authenticated.

All other fields list out correctly, only have an issue with SiteUrl.

Which version of the PnP-PowerShell Cmdlets are you using?

• [ ] PnP PowerShell for SharePoint 2013
• [ ] PnP PowerShell for SharePoint 2016
• [X ] PnP PowerShell for SharePoint Online

What is the version of the Cmdlet module you are running?

2.20.17

How did you install the PnP-PowerShell Cmdlets?

• [ ] MSI Installed downloaded from GitHub
• [X ] Installed through the PowerShell Gallery with Install-Module
• [ ] Other means

[dnbarrett]

Hi there,

I'm experiencing the same issue when using SharePointPnPPowerShellOnline version 2.21.1712.2.

This occurs when using "Get-PnPUnifiedGroup -Identity $groupName" for a newly created group.

Running Get-PnPUnifiedGroup without parameters takes around 40 seconds to return all groups. Perhaps 50% of these also show "The caller is not authenticated." for Site URL.

I'm connecting using Connect-PnPOnline -Scopes "Group.ReadWrite.All","User.Read.All". Using Connect-PnPMicrosoftGraph makes no difference.

[JeroenDerde]

Hi,

Also have the same experience when using SharePointPnPPowerShellOnline version: 2.23.1802.0
This occurs when using "Get-PnPUnifiedGroup" to get a list of all groups.
The output shows "The caller is not authenticated." for Site URL fo many sites.

I'm connecting using Connect-PnPOnline -Scopes "Group.ReadWrite.All"

[addition] tried connecting using the following scopes:
Connect-PnPOnline -Url "https://[tenant].sharepoint.com" -Scopes “Group.ReadWrite.All”,”User.Read.All”,”Directory.Read.All”,“Sites.Read.All”

because I saw in the sourcecode (OfficeDevPnP.Core.Framework.Graph.UnifiedGroupsUtility.GetUnifiedGroupSiteUrl) that the Groups Drive is used to get the siteUrl, but this does not result in a difference in output.
[/addition]

Also, I'm missing several groups in the output list.

Any idea as to the cause of this behavior?

[DeanGross]

it may mean that you are not a member/owner of the groups and therefore don't have access to the SPO sites, SPO/Global admins don't have access to every SPO site by default, it needs to be explicitly granted.

[charlesmln]

I am also experiencing the same issue and I believe not being member of the group should not prevent from displaying the site URL.

Connect-PnPOnline -Url 'https://myorg-admin.sharepoint.com' -Scopes "Group.ReadWrite.All","User.Read.All","Directory.Read.All","Sites.Read.All"
New-PnPUnifiedGroup -DisplayName 'Name' -Description 'Description' -MailNickname 'grp-xxx' -Owners
@('[email protected]') -IsPrivate:$True
Get-PnpUnifiedGroup -Identity 'grp-xxx' | Select SiteUrl

SiteUrl
-------
The caller does not have permission to perform the action.

[sionjlewis]

The following code works for me:

Connect-PnPOnline -Scopes "Group.ReadWrite.All","User.Read.All","Directory.Read.All","Sites.Read.All";
Get-PnPUnifiedGroup;

[westerdaled]

@sionjlewis I also tried your connection scope and out of the 999 groups returned:

($unifiedGroups.Where( {$_.SiteURL -Like "The caller does not*" } )).count

425 had a Site URL of

The caller does not have permission to perform the action.

As a GA I would have hoped to be able to view these URs without going to the admin portal.

[sionjlewis]

@sionjlewis I also tried your connection scope and out of the 999 groups returned:

($unifiedGroups.Where( {$_.SiteURL -Like "The caller does not*" } )).count

425 had a Site URL of

The caller does not have permission to perform the action.

As a GA I would have hoped to be able to view these URs without going to the admin portal.

Yes, as a Global Admin you would expect CmdLet to give you at least the same functionality as the UI. This is a question for the PnP Team and/or Microsoft...