Pnpframework: Error when provisioning a template with a TeamSite and MS Teams (or teamify)

[luismanez]

When provisioning a Template that contains a pnp:TeamSite, and a MS teams node (or just the "teamify" attribute in the TeamSite), you get an exception from MS Graph API, as the Group behind the TeamSite was created with no Owners nor Members.

As far as we've seen debugging, the Teams object handler is calling:

private static string CreateOrUpdateTeamFromGroupInternal(PnPMonitoredScope scope, Team team, TokenParser parser, string groupId, string accessToken)

and that method calls the Graph helper

teamId = GraphHelper.CreateOrUpdateGraphObject(scope,
                    HttpMethodVerb.PUT,
                    $"{GraphHelper.MicrosoftGraphBaseURI}v1.0/groups/{groupId}/team",
                    content,
                    HttpHelper.JsonContentType,
                    accessToken,
                    "Conflict",
                    CoreResources.Provisioning_ObjectHandlers_Teams_Team_AlreadyExists,
                    "id",
                    parser.ParseString(team.GroupId),
                    CoreResources.Provisioning_ObjectHandlers_Teams_Team_ProvisioningError,
                    canPatch: true);

and although there´s no Exception, the TeamId is returned as null, as the helper is catching the MS Graph API exception. The request to Graph API is:

PUT https://graph.microsoft.com/v1.0/groups/{group_id}/team HTTP/1.1

{"funSettings":{"allowGiphy":true,"giphyContentRating":"moderate","allowStickersAndMemes":true,"allowCustomMemes":true},"guestSettings":{"allowCreateUpdateChannels":false,"allowDeleteChannels":false},"memberSettings":{"allowCreateUpdateChannels":true,"allowAddRemoveApps":true,"allowDeleteChannels":true,"allowCreateUpdateRemoveTabs":true,"allowCreateUpdateRemoveConnectors":true,"allowCreatePrivateChannels":false},"messagingSettings":{"allowUserEditMessages":true,"allowUserDeleteMessages":true,"allowOwnerDeleteMessages":true,"allowTeamMentions":true,"allowChannelMentions":true}}

and the response says clearly that there´s no Owner for that group.

{
  "error": {
    "code": "BadRequest",
    "message": "Team owner not found for group 10107cf.........633.",
    "innerError": {
      "date": "2021-01-27T15:37:35",
      "request-id": "9f4beda6-....1deb8f",
      "client-request-id": "9f4b......deb8f"
    }
  }
}

the problem here is that we cannot specify an Owner when creating the TeamSite, as the PnP Schema doesn´t allow it.

Any thoughts here? @PaoloPia @jansenbe

Many thanks.

[gautamdsheth]

@luismanez - can you share the minimal template to repro this ? Also , what kind of auth are you using for provisioning ?

[luismanez]

About Auth, we´re using App Only with Certificate, so we are providing a PnPProvisioningContext with a custom function that returns a valid Token for Graph, so the Group is created through Graph, but no Owner is assigned, so the next call to Graph to temify the group, fails.

About the template, this one should fail (haven't tested it, as my workmate has the real one and I´ll post it tomorrow, but this one should fail, as happens with any TeamSite that has a Teams, and the Auth is AppOnly)

<pnp:Provisioning xmlns:pnp="http://schemas.dev.office.com/PnP/2020/02/ProvisioningSchema"
                  Author="John White"
                  Generator="Human being"
                  Version="1.0"
                  Description="A sample Provisioning document"
                  DisplayName="Sample Provisioning"
                  ImagePreviewUrl="https://sharepointpnp.com/ImagePreview.png">

  <pnp:Templates ID="SAMPLE-TEMPLATES">

    <pnp:ProvisioningTemplate ID="SPECIALTEAM" Version="1.0"
      BaseSiteTemplate="STS#0"
      ImagePreviewUrl="https://preview.png"
      DisplayName="Special Team Site"
      Description="This is a Special Team Site for custom provisioning"
      Scope="RootSite"
      TemplateCultureInfo="1033">

      <pnp:PropertyBagEntries>
        <pnp:PropertyBagEntry Key="KEY1" Value ="value1" Overwrite="true" />
        <pnp:PropertyBagEntry Key="KEY2" Value ="value2" />
      </pnp:PropertyBagEntries>    

    </pnp:ProvisioningTemplate>

  </pnp:Templates>

  <pnp:Sequence ID="SAMPLE-SEQUENCE">

    <pnp:SiteCollections>      

      <pnp:SiteCollection xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="pnp:TeamSite"
                          ProvisioningId="SITE.01"
                          Title="PnPTest"
                          Alias="PnPTest"
                          DisplayName="PnPTest"
                          IsPublic="false"
                          IsHubSite="false"
                          Description="Just a TeamSite"
                          Teamify="true"
                          Language="1033">
        <pnp:Templates>
          <pnp:ProvisioningTemplateReference ID="SPECIALTEAM" />
        </pnp:Templates>
      </pnp:SiteCollection>
    </pnp:SiteCollections>

  </pnp:Sequence>  

</pnp:Provisioning>

[luismanez]

I can confirm that the template posted above is enough to get the error when using App Only auth. Code below is how we´re calling ApplyTenantTemplate:

            using (new PnPProvisioningContext((resource, scope) => tokenProvider.GetAccessToken(resource, scope)))
            {
                using var tenantContext = await sharePointContextProvider.GetTenantContext();
                var tenant = new Tenant(tenantContext);

                tenant.ApplyTenantTemplate(provisioningHierarchy, provisioningHierarchy.Sequences[0].ID, applyingInformation);
            }

The tokenProvider.GetAccessToken function is returning a valid token for MS Graph. Actually, the Group is created using Graph API, but as the framework is not adding any Owner to the group, and using AppOnly token, no Owners are added to the Group, and the next call to configure the MS Teams team (teamify group), fails with the error already mentioned below.

I think the solution here is to allow to pass an Owner from the Schema, like actually is already done with _pnp:TeamSiteNoGroup_

BTW, also tested to create a TeamSite with NO Group, and then tried to Groupify and Temify, but in this case it also fails in a different point.

[gautamdsheth]

@luismanez - this is a bit "complex" , requiring us to change the schema to support owners property which might take sometime .

As a temporary workaround , we can try it as below using the UnifiedGroupsUtility's CreateUnifiedGroup method. You can specify the owner array as well and pass the same access token inside the PnPProvisioningContext. Once the group + team are created, you can then apply the PnP Template to the created team site.

var group = var group = UnifiedGroupsUtility.CreateUnifiedGroup("display name", "desc", "mailNickName", accessToken, owners[], createTeam: true);
var siteUrl = group.SiteUrl;

using(ClientContext ctx = new ClientContext(siteUrl))
{
    ctx.Web.ApplyProvisioningTemplate
}

[luismanez]

Hi @gautamdsheth, thanks for coming back. This is pretty much what we are doing, but it´s not great, as we wanted all the "creation" stuff solved by the PnPFramework when calling ApplyTenantTemplate.

I understand changing the schema is not easy, but this one is quite inconsistent, as you can set the Owner to the TeamSiteNoGroup, but not the TeamSite. Also, it´d be good to know why the TeamSiteNoGroup with the Groupify option is not working with AppOnly, which has been also reported here: https://github.com/pnp/pnpframework/issues/146

Many thanks again!

[github-actions[bot]]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days