Pnp-sites-core: Connect-PnPOnline UseWebLogin parameter returns 403 on Apply-PnPProvisioningTemplate

[2toLeadMike]

Category

[X] Bug
[ ] Enhancement

Environment

[X] Office 365 / SharePoint Online
[ ] SharePoint 2016
[ ] SharePoint 2013

Note: Tried with PnP PowerShell 3.6.1902.2 and again with 3.7.1903.0 (latest at this time) with same results.

Expected or Desired Behavior

Should be able to deploy PnP Provisioning Templates with same reliability when using -UseWebLogin parameter with Connect-PnPOnline in order to deploy within an MFA account.

Observed Behavior

When deploying certain tenant configuration adjustments via Provisioning XML (i.e. <pnp:Tenant>) everything works well. But when -UseWebLogin is used to connect (regardless of whether or not MFA is enabled) it will fail on many of our templates.

It returns the following error:

Apply-PnPProvisioningTemplate : The remote server returned an error: (403) Forbidden.
At line:1 char:1

• Apply-PnPProvisioningTemplate .\PnP_TenantApp.xml -Handlers Tenant
• ~~~~~~~~~~~~~~
  
  
  
  • CategoryInfo : WriteError: (:) [Apply-PnPProvisioningTemplate], WebException
  
  
  • FullyQualifiedErrorId : EXCEPTION,SharePointPnP.PowerShell.Commands.Provisioning.Site.ApplyProvisioningTemplate
  
  

We have found ways around this in some cases by connecting to the admin URL (i.e. tenant-admin.sharepoint.com) however this only seems to help in certain cases.

Steps to Reproduce

Run the following:

1. Connect via Connect-PnPOnline -Url "https://tenant.sharepoint.com" -UseWebLogin
2. Run Apply-PnPProvisioningTemplate .\Test.xml (See below for XML)

Test.xml
<pnp:Provisioning xmlns:pnp="http://schemas.dev.office.com/PnP/2018/07/ProvisioningSchema"> <pnp:Preferences Generator="OfficeDevPnP.Core, Version=3.6.1902.0, Culture=neutral, PublicKeyToken=5e633289e95c321a" /> <pnp:Tenant> <pnp:StorageEntities> <pnp:StorageEntity Key="TEST" Value="TEST" /> </pnp:StorageEntities> </pnp:Tenant> <pnp:Templates ID="CONTAINER-PORTAL_TENANT_SETTINGS"> <pnp:ProvisioningTemplate ID="PORTAL_TENANT_SETTINGS" Version="1" ImagePreviewUrl="https://preview.png" DisplayName="Tenant Configuration" Description="" TemplateCultureInfo="1033" Scope="RootSite" /> </pnp:Templates> </pnp:Provisioning>

[jansenbe]

Does Connect-PnPOnline -Url yoururl -SPOManagementShell -ClearTokenCache not work?

[2toLeadMike]

@jansenbe I think this what I was looking for earlier! This is the modern authentication approach, correct? I ran it and was able to go through MFA and still be able to deploy. Thanks!

Does this make UseWebLogin obsolete? This seems odd as #1924 had a similar issue and the fix was going from SPOManagementShell to UseWebLogin (vice versa)

[jansenbe]

Well...kind off, we did some optimization work for SPOManagementShell + did improve the context cloning which is required to work properly before you can clone a template. Glad to hear it works now.

[2toLeadMike]

@jansenbe Actually hm. Today I am trying to upgrade the script and getting the 401 again. Odd. I closed down everything and booted up a fresh PS and tried the following:

Connect-PnPOnline -Url "https://mytenant.sharepoint.com" -SPOManagementShell -ClearTokenCache
Apply-PnPProvisioningTemplate -Path .\test.xml

Apply-PnPProvisioningTemplate : The remote server returned an error: (401) Unauthorized.

Connect-PnPOnline -Url "https://mytenant.sharepoint.com/sites/app" -SPOManagementShell -ClearTokenCache
Apply-PnPProvisioningTemplate -Path .\test.xml

Apply-PnPProvisioningTemplate : The remote server returned an error: (401) Unauthorized.

Connect-PnPOnline -Url "https://mytenant-admin.sharepoint.com/" -SPOManagementShell -ClearTokenCache
Apply-PnPProvisioningTemplate -Path .\test.xml

WARNING: Tenant app catalog doesn't exist. Provisioning of storage entities will be skipped!

Any thoughts?

[wkwolff]

Did you ever figure this out?

I'm receiving the same error when trying to apply template and we have MFA on here.

Apply-PnPProvisioningTemplate : Access denied. You do not have permission to perform this action or access this
resource.
At line:1 char:1
Apply-PnPProvisioningTemplate -Path teamSite.xml
CategoryInfo : WriteError: (:) [Apply-PnPProvisioningTemplate], ServerUnauthorizedAccessException
FullyQualifiedErrorId : EXCEPTION,SharePointPnP.PowerShell.Commands.Provisioning.Site.ApplyProvisioningTemplate

[2toLeadMike]

@wkwolff No right now we are having to enforce deployments with MFA temporary turned off. @jansenbe any idea as to the above issues?

[Zerg00s]

@2toLeadMike, @wkwolff . I have just tried deploying Tenant-level Entities with MFA and no-luck. Works perfectly fine without MFA.

Apply-PnPProvisioningTemplate : Object reference not set to an instance of an object.
At C:...\Deploy.ps1:117 char:5
Apply-PnPProvisioningTemplate -Path ./Core/PnP_TenantSettings.xml ...
~~~~~~~~~~~~~
CategoryInfo : WriteError: (:) [Apply-PnPProvisioningTemplate], NullReferenceException
FullyQualifiedErrorId : EXCEPTION,SharePointPnP.PowerShell.Commands.Provisioning.Site.ApplyProvisioningTemplate

Get-PnPException

Get-PnPException : Unable to cast object of type 'System.Management.Automation.ActionPreferenceStopException' to type 'System.Management.Automation.ErrorRecord'.
At line:1 char:1
Get-PnPException
~~~~
CategoryInfo : NotSpecified: (:) [Get-PnPException], InvalidCastException
FullyQualifiedErrorId : System.InvalidCastException,SharePointPnP.PowerShell.Commands.Base.GetException

Replication steps:

PnP_TenantSettings.xml

<pnp:Provisioning xmlns:pnp="http://schemas.dev.office.com/PnP/2019/03/ProvisioningSchema">
  <pnp:Preferences Generator="OfficeDevPnP.Core, Version=3.11.1907.0, Culture=neutral, PublicKeyToken=5e633289e95c321a"></pnp:Preferences>
  <pnp:Tenant>
    <pnp:StorageEntities>
      <pnp:StorageEntity Key="ROOT_CONFIG_SERVER_RELATIVE_URL" Value="/" />
      <pnp:StorageEntity Key="CONFIG_LIST_TITLE" Value="Solution Configuration" />
    </pnp:StorageEntities>
  </pnp:Tenant>
  <pnp:Templates ID="CONTAINER-PORTAL_TENANT_SETTINGS">
    <pnp:ProvisioningTemplate ID="PORTAL_TENANT_SETTINGS" Version="1" ImagePreviewUrl="https://preview.png" DisplayName="Tenant Configuration" Description="" TemplateCultureInfo="1033" Scope="RootSite" />
  </pnp:Templates>
</pnp:Provisioning>

Script

Connect-PnPOnline -Url https://Tenant-admin.sharepoint.com -SPOManagementShell -ClearTokenCache
Apply-PnPProvisioningTemplate -Path ./PnP_TenantSettings.xml -Parameters @{ "IntranetHomeServerRelativeURL" = "/"; }

Log:

PS C:\Trash\camdenLiving\CMD\Deploy> Apply-PnPProvisioningTemplate -Path ./Core/PnP_TenantSettings.xml -Parameters @{ "IntranetHomeServerRelativeURL" = "/"; }
powershell_ise.exe Information: 0 : 2019-09-12 11:35:55.0150    [OfficeDevPnP.Core] [0] [Information]   File PnP_TenantSettings.x
ml retrieved from folder    0ms 
powershell_ise.exe Information: 0 : 2019-09-12 11:35:55.0266    [OfficeDevPnP.Core] [0] [Information]   File PnP_TenantSettings.x
ml retrieved from folder    0ms 
powershell_ise.exe Information: 0 : 2019-09-12 11:35:55.0526    [Provisioning]  [18]    [Debug] Code execution scope started    0ms ab
ac7013-bad0-402c-9628-a6f3bd7a3f09
powershell_ise.exe Information: 0 : 2019-09-12 11:35:55.0546    [Provisioning]  [18]    [Information]   ProgressDelegate registered 1
ms  abac7013-bad0-402c-9628-a6f3bd7a3f09
powershell_ise.exe Information: 0 : 2019-09-12 11:35:55.0566    [Provisioning]  [18]    [Information]   MessagesDelegate registered 3
ms  abac7013-bad0-402c-9628-a6f3bd7a3f09
powershell_ise.exe Information: 0 : 2019-09-12 11:35:55.9019    [Extensibility Providers]   [18]    [Debug] Code execution scope sta
rted    0ms abac7013-bad0-402c-9628-a6f3bd7a3f09
powershell_ise.exe Information: 0 : 2019-09-12 11:35:55.9059    [Extensibility Providers]   [18]    [Debug] Code execution scope end
ed  4ms abac7013-bad0-402c-9628-a6f3bd7a3f09
powershell_ise.exe Information: 0 : 2019-09-12 11:35:56.0115    [ProvisioningTemplate WebHook Call] [18]    [Debug] Code execution
 scope started  0ms abac7013-bad0-402c-9628-a6f3bd7a3f09
powershell_ise.exe Information: 0 : 2019-09-12 11:35:56.0155    [ProvisioningTemplate WebHook Call] [18]    [Debug] Code execution
 scope ended    3ms abac7013-bad0-402c-9628-a6f3bd7a3f09
powershell_ise.exe Information: 0 : 2019-09-12 11:35:56.0225    [ProvisioningTemplate WebHook Call] [18]    [Debug] Code execution
 scope started  0ms abac7013-bad0-402c-9628-a6f3bd7a3f09
powershell_ise.exe Information: 0 : 2019-09-12 11:35:56.0245    [ProvisioningTemplate WebHook Call] [18]    [Debug] Code execution
 scope ended    2ms abac7013-bad0-402c-9628-a6f3bd7a3f09
powershell_ise.exe Information: 0 : 2019-09-12 11:35:56.0275    [Tenant Settings]   [18]    [Debug] Code execution scope started    0ms
    abac7013-bad0-402c-9628-a6f3bd7a3f09
powershell_ise.exe Information: 0 : 2019-09-12 11:35:56.3177    [Tenant Settings]   [18]    [Debug] Code execution scope ended  290ms
    abac7013-bad0-402c-9628-a6f3bd7a3f09
powershell_ise.exe Information: 0 : 2019-09-12 11:35:56.3217    [Provisioning]  [18]    [Debug] Code execution scope ended  1268ms  a
bac7013-bad0-402c-9628-a6f3bd7a3f09
Apply-PnPProvisioningTemplate : Object reference not set to an instance of an object.
At line:1 char:1
+ Apply-PnPProvisioningTemplate -Path ./Core/PnP_TenantSettings.xml -Pa ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : WriteError: (:) [Apply-PnPProvisioningTemplate], NullReferenceException
    + FullyQualifiedErrorId : EXCEPTION,SharePointPnP.PowerShell.Commands.Provisioning.Site.ApplyProvisioningTemplate

Get-PnPException

Apply-PnPProvisioningTemplate : Object reference not set to an instance of an object.
At line:1 char:1

• Apply-PnPProvisioningTemplate -Path ./Core/PnP_TenantSettings.xml -Pa ...
• ~~~~~~~~~~~~~~~~~
  
  
  
  • CategoryInfo : WriteError: (:) [Apply-PnPProvisioningTemplate], NullReferenceException
  
  
  • FullyQualifiedErrorId : EXCEPTION,SharePointPnP.PowerShell.Commands.Provisioning.Site.ApplyProvisioningTemplate