I'm trying to run PnP PowerShell from an Azure Automation Runbook to update and publish employee data on a SharePoint portal. The existing runbook was built entirely with PnP PowerShell, so switching to Microsoft Graph would require a larger rewrite.
Our tenant uses a custom PnP PowerShell app registration rather than the older shared application. I configured a federated credential that maps the app registration to the Automation Account's managed identity and granted several permissions, but every authentication attempt still returns 401 Unauthorized. I also tried using Add-PnPEntraIDServicePrincipalAppRole to assign permissions to the managed identity, using both the PnP application's object ID and application ID, but received errors such as "Service principal not found" and "Resource not found."
What is the correct end-to-end setup for authenticating PnP PowerShell to SharePoint from an Azure Automation Runbook with a managed identity?
1 Answer
If the runbook can be rewritten, Microsoft Graph is usually much simpler for this scenario. You can grant the Automation Account’s managed identity the appropriate SharePoint site permissions directly through its service principal, without creating a separate application registration or configuring a federated credential. Several runbooks use Graph successfully for SharePoint operations this way.
The important distinction is that the managed identity itself needs to receive the Graph application permissions; assigning permissions to the PnP app registration won’t automatically grant them to the identity.
Unfortunately, changing to Graph isn’t currently practical. The existing employee-data runbook was built entirely with PnP PowerShell, and the team is also considering certificate-based authentication. I was hoping to get managed identity authentication working first so we could compare the options.