Thank you!

@pnp/cli-for-microsoft-365-maintainers is anyone aware of this change?

Thank you!

@pnp/cli-for-microsoft-365-maintainers is anyone aware of this change?

Hi Milan, I'm the EM owner for api.powerapps.com and I also work closely with the team that owns api.bap.microsoft.com, accepting the ARM audience has been a longstanding issue which we are in the process of correcting (effectively by stop accepting it).

Hi @milanholemans - Considering the audience has changed, I am thinking will just updating the API endpoint domain will work? because I tried to get a token with "https://service.powerapps.com/" and currently CLI does not have token with this new aud

Hi @milanholemans - Considering the audience has changed, I am thinking will just updating the API endpoint domain will work? because I tried to get a token with "https://service.powerapps.com/" and currently CLI does not have token with this new aud

This means that users would need to consent to these audiences. This is part of the issue we are trying to solve, right now there is no consent required for these resources which bypasses the security expectations of tenant admins.

thanks @milanholemans for rising this up 👍.
I will try to check this one today. @pnp/cli-for-microsoft-365-maintainers is anyone already experiencing this change?

The old resource name is still working for my tenant.

This means that users would need to consent to these audiences. This is part of the issue we are trying to solve, right now there is no consent required for these resources which bypasses the security expectations of tenant admins.

hmm... so our current implementation, at least for now, works fine on my tenant. When double checked this change on two tenants that I have on both I get the same error message

on both I did the reconsent for the CLI app 🤔.

@alanc-msft could you provide more detail on the issue? I guess before it is not solved we should not merge this one.
@pnp/cli-for-microsoft-365-maintainers could someone also take a look if this change fails on your tenant?

hmm... so our current implementation, at least for now, works fine on my tenant. When double checked this change on two tenants that I have on both I get the same error message

on both I did the reconsent for the CLI app 🤔.

@alanc-msft could you provide more detail on the issue? I guess before it is not solved we should not merge this one. @pnp/cli-for-microsoft-365-maintainers could someone also take a look if this change fails on your tenant?

My guess is that the permission scope still has to be added to the PnP app registration, but no clue which one 😊.

This means that users would need to consent to these audiences. This is part of the issue we are trying to solve, right now there is no consent required for these resources which bypasses the security expectations of tenant admins.

hmm... so our current implementation, at least for now, works fine on my tenant. When double checked this change on two tenants that I have on both I get the same error message

on both I did the reconsent for the CLI app 🤔.

@alanc-msft could you provide more detail on the issue? I guess before it is not solved we should not merge this one. @pnp/cli-for-microsoft-365-maintainers could someone also take a look if this change fails on your tenant?

Hi Adam, how does the process to consent to the ARM audience work for this library? Typically for a multitenant third-party application to get access to a specific resource, users need to consent. The consent can be done explicitly in Azure portal by an admin, or by directing the users to the right consent url. I would expect the same process to be the same for these resources.

I would expect the same process to be the same

yes. that is exactly how it works in this case as well. The user when login goes over https://aka.ms/devicelogin and the app authenticate to user tenant on his or her behalf. For first time user has to approve the permission list CLI is using.
Please refer to https://pnp.github.io/cli-microsoft365/user-guide/connecting-office-365/

CLI uses the following permissions:

• Microsoft 365 SharePoint Online
• Have full control of all site collections
• Read user profiles
• Read and write managed metadata
• Microsoft Graph
• Read and write to all app catalogs
• Read and write all groups
• Read and write directory data
• Access directory as the signed in user
• Read and write identity providers
• Read and write access to user mail
• Send mail as a user
• Read all usage reports
• Manage user's installed Teams apps
• Invite guest users to the organization
• Create, read, update and delete user tasks and projects
• Microsoft 365 Management APIs
• Read service health information for your organization
• Windows Azure Active Directory
• Access the directory as the signed-in user
• Windows Azure Service Management API
• Access Azure Service Management as organization users
• Yammer
• Read and write to the Yammer platform

this is the list:

Microsoft Graph	RecordsManagement.ReadWrite.All	Read and write Records Management configuration, labels, and policies
Microsoft Graph	ExternalConnection.ReadWrite.All	Read and write all external connections
Microsoft Graph	ServiceMessageViewpoint.Write	Update user status on service announcement messages
Microsoft Graph	Place.Read.All	Read all company places
Microsoft Graph	Chat.Read	Read user chat messages
Microsoft Graph	Chat.ReadWrite	Read and write user chat messages
Microsoft Graph	Policy.Read.All	Read your organization's policies
Microsoft Graph	AppCatalog.ReadWrite.All	Read and write to all app catalogs
Microsoft Graph	AuditLog.Read.All	Read audit log data
Microsoft Graph	SecurityEvents.Read.All	Read your organization’s security events
Microsoft Graph	Notes.Read.All	Read all OneNote notebooks that user can access
Microsoft Graph	User.Invite.All	Invite guest users to the organization
Microsoft Graph	Reports.Read.All	Read all usage reports
Microsoft Graph	Mail.Read.Shared	Read user and shared mail
Microsoft Graph	Group.ReadWrite.All	Read and write all groups
Microsoft Graph	Directory.ReadWrite.All	Read and write directory data
Microsoft Graph	Directory.AccessAsUser.All	Access directory as the signed in user
Microsoft Graph	Mail.ReadWrite	Read and write access to user mail
Microsoft Graph	Mail.Send	Send mail as a user
Microsoft Graph	IdentityProvider.ReadWrite.All	Read and write identity providers
Microsoft Graph	Bookings.Read.All	Read bookings information
Microsoft Graph	ChannelMessage.Send	Send channel messages
Microsoft Graph	TeamsTab.ReadWrite.All	Read and write tabs in Microsoft Teams.
Microsoft Graph	ChannelSettings.ReadWrite.All	Read and write the names, descriptions, and settings of channels
Microsoft Graph	TeamSettings.ReadWrite.All	Read and change teams' settings
Microsoft Graph	TeamMember.ReadWrite.All	Add and remove members from teams
Microsoft Graph	ChannelMember.ReadWrite.All	Add and remove members from channels
Microsoft Graph	ChannelMessage.Read.All	Read user channel messages
Microsoft Graph	TeamsAppInstallation.ReadWriteForUser	Manage user's installed Teams apps
Microsoft Graph	Team.Create	Create teams
Microsoft Graph	ServiceMessage.Read.All	Read service announcement messages
Microsoft Graph	ServiceHealth.Read.All	Read service health
Microsoft Graph	Tasks.ReadWrite	Create, read, update, and delete user’s tasks and task lists

Dataverse	user_impersonation	Access Common Data Service as organization users

Office 365 Management APIs	ActivityFeed.Read	Read activity data for your organization
Office 365 Management APIs	ServiceHealth.Read	Read service health information for your organization

Office 365 SharePoint Online	TermStore.ReadWrite.All	Read and write managed metadata
Office 365 SharePoint Online	AllSites.FullControl	Have full control of all site collections
Office 365 SharePoint Online	User.ReadWrite.All	Read and write user profiles

Power BI Service	Dataset.Read.All	View all datasets

Windows Azure Active Directory	Directory.AccessAsUser.All	Access the directory as the signed-in user

Windows Azure Service Management API	user_impersonation	Access Azure Service Management as organization users

maybe there is something we are missing here 🤔

@nanddeepn since you are already experiencing this issue as you mentioned in #4491 may I kindly ask you to help us out and retest changes done in this PR?
For now lets wait for @alanc-msft with the info if maybe we are lacking some permissions 🤔

@alanc-msft there are some resources that can be granted only to first-party (Microsoft's) applications. I wonder if https://service.powerapps.com/ isn't one of those resources. Do you have more information about to which service principal it belongs?

I just found out that we can get an access token for service.powerapps.com by adding to our consent list:

Before we do, let's verify that all commands will work with this new token. After we confirmed this, we can add the scope to our app reg and update the code to use the new resource for PP-related commands.

I just found out that we can get an access token for service.powerapps.com by adding to our consent list:

Before we do, let's verify that all commands will work with this new token. After we confirmed this, we can add the scope to our app reg and update the code to use the new resource for PP-related commands.

Yes, 475226c6-020e-4fb2-8a90-7a972cbfc1d4 is the correct application id

TBH I am having little luck testing this change 😟. What I did is I added a custom app registration that has all the CLI scopes and this new additional one which @waldekmastykarz pointed out

I logged in to CLI using my custom app registration with this additional scope. The CLI was build based on this branch.
unfrotonatly I am still getting the same error when trying to execute any pp command 😟

@waldekmastykarz am I missing something 🤔
@pnp/cli-for-microsoft-365-maintainers could someone also have a double check on this one and maybe try to do the same ?

@Adam-it have you tried running m365 cli reconsent to force reconsent of your custom app?

@Adam-it have you tried running m365 cli reconsent to force reconsent of your custom app?

Logged out and logged in. On login I guess we check for scopes that need consent right?

Nope, reconsent is a different flow

Nope, reconsent is a different flow

🤦‍♂️. Will recheck it today 🫡. Thanks for the tip

Nope, reconsent is a different flow

Ok after I reconsent the pa commands start to work normally and properly 👍 those mainly base on https://api.powerapps.com resource

but still the pp commands fail with the same error as above. Seems like all that base on https://api.bap.microsoft.com still wont work I wonder if we are still missing some permission we should also add to CLI.

@waldekmastykarz did you maybe find time to check it on your side?
@alanc-msft any tips on any additional permission we should include except this one

I can't seem to find any service principal linked to https://api.bap.microsoft.com which would explain why requesting an access token for it is failing. @alanc-msft any pointers as to what are we missing?

Hi @alanc-msft - checking if you have any updates on this ?

@alanc-msft do you maybe found some time to give it a check? I think the finish line is just around the corner and we need a bit more help from you to point us in the right direction (scope/permission 😉) 🙏

@alanc-msft do you maybe found some time to give it a check? I think the finish line is just around the corner and we need a bit more help from you to point us in the right direction (scope/permission 😉) 🙏

Hey I apologize for the delay, I believe the issue is that the audience for the BAP API, maps to a different first party application, so the preauthorization will also need to be added to that one. The problem with that one is that there may not be guarantee that it exists in the tenant, this is the app as a reference: "Power Platform Environment Service" app id: 0e0bf3cc-3078-4fd4-9ef3-cb6dc0245b10

For now I will go ahead and revert that application and leave just the Power Apps one, which is the one we are trying to fix sooner and I'll talk to the team owning the BAP API to figure out their own approach.

ok seems clear.
thanks @alanc-msft for your quick response 👍 I will try to have a check on this one tomorrow and for now we may only proceed with PowerApps Service

ok seems clear. thanks @alanc-msft for your quick response 👍 I will try to have a check on this one tomorrow and for now we may only proceed with PowerApps Service

I ended up updating both to the same resource, as it is still better than the ARM one (BAP api accepts the PA resource and will continue to do so for longer)

I ended up updating both to the same resource, as it is still better than the ARM one (BAP api accepts the PA resource and will continue to do so for longer)

thanks for the additional comment 👍 I will give it a check 👍

Thank you so much for your help @alanc-msft. We really appreciate it 👏

This was a long one but I guess we are at the finish line 👍
@alanc-msft thank you for your awesome work and help. You rock 🤩
@waldekmastykarz may I kindly ask you to support me in adding the additional permission: PowerApps Service (475226c6-020e-4fb2-8a90-7a972cbfc1d4) to the 'PnP Management Shell' app 🙏?
@siddharth-vaghasia I guess you wanna double check the outcome of this PR for your changes 😉👍
after this is done I guess we are ready to merge 🚀

This was a long one but I guess we are at the finish line 👍 @alanc-msft thank you for your awesome work and help. You rock 🤩 @waldekmastykarz may I kindly ask you to support me in adding the additional permission: PowerApps Service (475226c6-020e-4fb2-8a90-7a972cbfc1d4) to the 'PnP Management Shell' app 🙏? @siddharth-vaghasia I guess you wanna double check the outcome of this PR for your changes 😉👍 after this is done I guess we are ready to merge 🚀

No problem!, does somebody with write access needs to merge this pull request?

No problem!, does somebody with write access needs to merge this pull request?

Yes, @Adam-it will merge it pretty soon I guess.

No problem!, does somebody with write access needs to merge this pull request?

Yes, @Adam-it will merge it pretty soon I guess.

Yep, will do that ASAP 👍

hi @Adam-it - once you merge it - please let us know which CLI beta version to install and test?

merged manually
@siddharth-vaghasia you may check the latest beta running npm i @pnp/cli-microsoft365@next

merged manually
@siddharth-vaghasia you may check the latest beta running npm i @pnp/cli-microsoft365@next

Don't forget the -g flag to install it globally 🙂