[BUG] Connect-PnPOnline MSAL (application) token not working

[me1299]

Issue Description

When attempting to authenticate to SharePoint Online using an MSAL token with Connect-PnPOnline, the command runs without errors, but all subsequent PnP commands return a 401 Unauthorized error.

Using Connect-PnPOnline -UseWebLogin works as expected.

Expected Behavior

When authenticating using an MSAL token, PnP commands should execute successfully with the expected permissions, just like when using -UseWebLogin.

Actual Behavior

• Running:

  $MsalToken = Get-MsalToken -TenantId $TenantId -ClientId $AppId -ClientSecret ($ClientSecret | ConvertTo-SecureString -AsPlainText -Force) -Scope 
  "https://******.sharepoint.com/.default" -ForceRefresh
  Connect-PnPOnline -Url "https://******.sharepoint.com" -AccessToken $MsalToken
  

Does not return an error. However, running any subsequent PnP cmdlets results in a 401 Unauthorized error. Additionally, the command executes instantly, which seems odd.

Using Connect-PnPOnline -UseWebLogin instead works fine.

The AccessToken has the right permission to access sites.

I have found several similar reports online regarding this issue, but none have provided an explanation as to why it is not working. This makes it difficult to determine whether the issue is due to a misconfiguration, a bug, or something else entirely.

[gautamdsheth]

hey @me1299 , this is a SharePoint online limitation.

https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread#can-i-use-other-means-besides-certificates-for-realizing-app-only-access-for-my-azure-ad-app

You need to use certificate authentication for app-only connection to SharePoint online.

We support that using Connect-PnPOnline as mentioned below:

https://pnp.github.io/powershell/cmdlets/Connect-PnPOnline.html#example-5

Client ID + Secret is not supported by SPO.

[gautamdsheth]

Weblogin is legacy as mentioned in the warning message. We will be removing that soon since it is not a secure way for auth.

If you need to use Client Secret, you need to use the old way, wont recommend it as this will be disabled by Microsoft next year.

https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azureacs

So, recommendation is to use Client Id + cert / Managed identity for app-only scenarios.