Get-PnPPlannerPlan Graph Permissions seems to be wrong in the docs (https://pnp.github.io/powershell/cmdlets/Get-PnPPlannerPlan.html)

[kasperbolarsen]

Reporting an Issue or Missing Feature

Issue

Expected behavior

In the https://pnp.github.io/powershell/cmdlets/Get-PnPPlannerPlan.html the required Graph permissions are: Required Permissions Microsoft Graph API: Group.ReadWrite.All Microsoft Graph API: Group.Read.All

Actual behavior

However, when I run $allPlannerPlansInGroup = Get-PnPPlannerPlan -Group $groupId -Connection $conn -erroraction stop in an Http triggered Azure Function (usingManaged Identity) I get a Graph Exception

Steps to reproduce behavior

Adding Tasks.ReadWrite.All permission to my managed Identity and it works

remove the Tasks.ReadWrite.All permission and wait awhile and the exception pops up again.

What is the version of the Cmdlet module you are running?

2.4.0

Which operating system/environment are you running PnP PowerShell on?

• [X] Windows
• [ ] Linux
• [ ] MacOS
• [ ] Azure Cloud Shell
• [ ] Azure Functions
• [ ] Other : please specify

I am not sure how to verify if this is a fluke and only is an issue when using Managed Identity in an Azure Function?

[jackpoz]

Planner used to support only delegated permissions, with application permissions being added in October 2022 https://devblogs.microsoft.com/microsoft365dev/announcing-updates-to-the-planner-api-in-microsoft-graph/ .

These are the new permissions (from https://learn.microsoft.com/en-us/graph/api/plannerplan-get?view=graph-rest-1.0&tabs=http#permissions )

Permission type	Least privileged permissions	Higher privileged permissions
Delegated	Tasks.Read	Tasks.ReadWrite, Group.Read.All, Group.ReadWrite.All
Application	Tasks.Read.All	Tasks.ReadWrite.All

Managed identity counts as Application, so that's why it's throwing that error.

A bit unsure if https://github.com/pnp/powershell/blob/b9916f48ee97c7857f6f6bddb9fefa4dacfc7bf5/src/Commands/Planner/GetPlannerPlan.cs#L10 should be changed to "Tasks.Read" or "Tasks.Read.All" , as the permissions are different depending on Delegated and Application.

[kasperbolarsen]

I would say both, or replacing the current with a link to https://learn.microsoft.com/en-us/graph/api/plannerplan-get?view=graph-rest-1.0&tabs=http#permissions as the current info is wrong and might cause problems

[gautamdsheth]

Hello @kasperbolarsen , we have fixed this with the latest nightly builds. Can you please try with tomorrow's or later builds and let us know if it works for you ?

[kasperbolarsen]

@gautamdsheth I would love to but I can't install the nightly build, isn't it signed ?

[gautamdsheth]

Maybe use the Install-module cmd with these parameters ?

[kasperbolarsen]

Hi Gautam, it sure looks like the issue has been resolved 😊

Thanks