I'm trying to authenticate to SharePoint from an Azure Automation Runbook with PnP PowerShell and a managed identity, but every approach I've tried returns 401 Unauthorized. We created our own PnP PowerShell app registration rather than using the older shared application. I added different permissions, configured a federated credential on the app registration that maps to the Automation Account's managed identity, and tried using Add-PnPEntraIDServicePrincipalAppRole to grant the identity access. However, the command reports "Service principal not found," and using the application ID results in "Resource not found." The existing runbook was built with PnP PowerShell to process employee data and publish it to our main SharePoint portal, so switching technologies may not be practical. Is there a straightforward, reliable way to set up managed-identity authentication for this scenario?
1 Answer
If the runbook can use Microsoft Graph instead of PnP PowerShell, managed identity authentication is considerably simpler. You can grant the managed identity’s service principal the appropriate SharePoint site roles directly, without creating a separate app registration or configuring federated credentials. Several runbooks use this approach successfully for SharePoint operations.
Unfortunately, the existing solution was built entirely with PnP PowerShell to process employee data and publish it to the company SharePoint portal. The goal is to test managed identity before committing to the certificate-based approach being proposed, so replacing the PnP implementation may not be feasible right now.