|

Connect PnPOnline: Every Way to Authenticate, and When to Use Each

ByG Vijai Kumar

Connect-PnPOnline supports fifteen types of authentication in PnP.PowerShell 2.12.0. Three of them are required, but two of those which you may have used without thinking were discontinued since September 2024.

See the list for your own version

Don’t believe what is written in a blog post, like this one. The parameter sets differ in each release, and what is written on the Internet is based on the latest version that existed at that time. Your machine

Get-Command Connect-PnPOnline -Syntax

Or just the authentication-related parameters:

(Get-Command Connect-PnPOnline).Parameters.Keys |
    Where-Object { $_ -match 'Interactive|WebLogin|Device|Certificate|Secret|Managed|Token' } |
    Sort-Object

On 2.12.0 that gives:

AccessToken
CertificateBase64Encoded
CertificatePassword
CertificatePath
ClientSecret
DeviceLogin
Interactive
ManagedIdentity
UserAssignedManagedIdentityAzureResourceId
UserAssignedManagedIdentityClientId
UserAssignedManagedIdentityObjectId
UseWebLogin

The three you will actually use

Interactive, you at a keyboard, signing in through a browser. This is the normal one.

Connect-PnPOnline `
    -Url "https://contoso.sharepoint.com/sites/Demo" `
    -ClientId "11111111-2222-3333-4444-555555555555" `
    -Interactive

Certificate, a scheduled script with nobody watching. No prompts, no password.

Connect-PnPOnline `
    -Url "https://contoso.sharepoint.com/sites/Demo" `
    -ClientId "11111111-2222-3333-4444-555555555555" `
    -Tenant contoso.onmicrosoft.com `
    -CertificatePath "C:\certs\PnP.pfx" `
    -CertificatePassword (ConvertTo-SecureString "yourpassword" -AsPlainText -Force)

Managed identity, running inside Azure Automation or an Azure Function. No secret to store anywhere, which is why it is the best option when you can use it.

Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/Demo" -ManagedIdentity

That is the whole decision. Interactive when you are there and certificate when you are not, or managed identity if you are in Azure.

What stopped working in September 2024

Two things, and they produce the same unhelpful error.

Interactive with no ClientId:

Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/Demo" -Interactive
WARNING: Connecting with -Interactive used the PnP Management Shell multi-tenant
App Id for authentication. As of September 9th, 2024 this option is not available
anymore.

Specified method is not supported.

Username and password:

$cred = Get-Credential
Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/Demo" -Credentials $cred
WARNING: As of September 9th, 2024 the option to use the PnP Management Shell app
registration for authentication is not available anymore.

Specified method is not supported.

Both were leaning on the shared PnP Management Shell app registration that Microsoft deleted. Register your own and both come back to life. I covered that in Connect-PnPOnline: Specified method is not supported.

UseWebLogin still works, and it is the only one that needs nothing

This surprised me. I expected it to be gone:

Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/Demo" -UseWebLogin
WARNING: Consider using -Interactive instead, which provides better functionality.

Then it makes the connection. No ClientId, no app registration, nothing.

How it works is that -UseWebLogin never made use of the PnP Management Shell app to begin with. It uses browser cookies for sign in, which means that the deletion of the app had no impact on it.

This is not recommended. This feature is deprecated, you are being warned of this fact, it doesn’t have a Microsoft Graph token, and it will eventually disappear. But if you find yourself in possession of an old broken script, one which needs to be working in the next ten minutes, and you can’t get your app registration in time, this is your bridge.

Next go register your app properly.

Device login needs one extra parameter

Device authentication logs out a code which you input on microsoft.com/devicelogin from any device, and the script runs. This is used when there is no browser on the device or over a remote session.

If you supply the ClientId parameter, you have to supply the Tenant parameter too, otherwise you get this

Please specify Tenant with either the tenant id or hostname.
Unable to connect using provided arguments

So:

Connect-PnPOnline `
    -Url "https://contoso.sharepoint.com/sites/Demo" `
    -ClientId "11111111-2222-3333-4444-555555555555" `
    -Tenant contoso.onmicrosoft.com `
    -DeviceLogin

The rest

The other parameter sets are real but narrow:

  • -AccessToken for when you already got a token some other way and just want PnP to use it.
  • -ClientSecret, app-only with a secret instead of a certificate. Works for some endpoints, but certificates are the supported path for SharePoint.
  • -EnvironmentVariable, reads the client ID from an environment variable so it is not sitting in your script.
  • -OSLogin, uses the account you are already signed into Windows with.
  • -AzureADWorkloadIdentity, for workloads running in Kubernetes.
  • -SPOManagementShell and -CurrentCredentials, legacy, do not start anything new with these.

If you are writing something new, use interactive while you build it and switch to a certificate when you schedule it. That covers almost everything.

Related posts

Similar Posts