Permission & Access Issues

Fix 401 Unauthorized Error in Get-PnPList with Connect-PnPOnline

Maira Mehtab Sep 21, 2026 868 views

Question details

A PowerShell script using Connect-PnPOnline encounters a 401 Unauthorized error when executing the Get-PnPList command, causing the script to halt.

Product: SharePoint Online / PnP PowerShell
Device & OS: not provided
Scenario: Running an automated PowerShell script using Connect-PnPOnline with a client ID and client secret to access SharePoint lists.
Observed behavior: The script fails with a 401 Unauthorized error precisely when Get-PnPList runs, stopping the remaining commands from executing.

Before you start

Ensure you have global or SharePoint administrator privileges in your Microsoft 365 tenant to configure Entra ID (formerly Azure AD) applications and grant necessary API permissions.

Solution 1Recommended

Use Certificate-Based Authentication for App-Only Access

Client secrets often fail with CSOM-based commands like Get-PnPList. Switch to using an Entra ID application configured with a certificate to ensure full compatibility with the SharePoint API.

Get-PnPList utilizes the SharePoint Client-Side Object Model (CSOM). While a client ID and secret may successfully obtain an initial token via Connect-PnPOnline, SharePoint Online often blocks CSOM requests authenticated this way, resulting in a 401 Unauthorized error. Microsoft requires certificate-based authentication for app-only access to CSOM endpoints.

Generate a Certificate

Create a self-signed certificate or obtain a CA-issued certificate. Export both the public key (.cer) and the private key (.pfx) to your local machine.

Upload to Entra ID

Log into the Microsoft Entra admin center, navigate to 'App registrations', select your app, go to 'Certificates & secrets', and upload the .cer file in the Certificates tab.

Update Your PowerShell Script

Modify your script to use the certificate instead of a client secret. Use the command syntax: Connect-PnPOnline -Url 'https://yourtenant.sharepoint.com' -ClientId 'YOUR_CLIENT_ID' -Tenant 'YOUR_TENANT.onmicrosoft.com' -CertificatePath 'C:\path\to\cert.pfx'.

Authentication Best Practice: Using certificate-based authentication is the most secure and fully supported method for non-interactive app-only scripts targeting SharePoint Online.

Solution 2

Review Entra ID API Permissions and Admin Consent

Even with a valid token or certificate, missing permissions or pending admin consent will result in a 401 error when attempting to read lists.

Solution 3

Consult the PnP Developer Community

If the error persists after configuring certificate-based authentication and permissions, seek specialized support from the developer community.

Free Microsoft Office alternative

Streamline Your Everyday Office Tasks with WPS Office

While you troubleshoot complex SharePoint scripts and PowerShell configurations, managing your daily documents shouldn't be a hassle. WPS Office provides a free, lightweight, and incredibly intuitive alternative to Microsoft Office. Enjoy comprehensive tools for Word, Excel, and PowerPoint files without the heavy enterprise overhead.

1. Download the Installer: Visit the official WPS Office website to download the free installation package tailored for your operating system.
2. Install WPS Office: Run the setup file and follow the brief prompts to install the lightweight suite in just a few minutes.
3. Manage Your Files: Open WPS Office and start editing your existing documents, spreadsheets, and presentations instantly with full formatting preserved.

High format compatibility with all standard Microsoft Office file types (.docx, .xlsx, .pptx).Lightweight application that launches quickly without consuming excessive system resources.Familiar tabbed user interface, allowing for seamless migration with zero learning curve.Built-in PDF editor and advanced AI assistance included.Completely free to download and use for your essential desktop document management.

Frequently Asked Questions

Why does Connect-PnPOnline work but Get-PnPList fail with a 401 error?

Connect-PnPOnline might successfully obtain an access token using a client secret. However, commands like Get-PnPList rely on the Client-Side Object Model (CSOM), which requires certificate-based authentication for app-only access. SharePoint blocks the CSOM call with a 401 Unauthorized error if only a secret is used.

Can I use a client secret for app-only authentication in PnP PowerShell?

While a client secret works for certain Microsoft Graph or REST API calls, it is not supported for CSOM-based commands in SharePoint Online. Microsoft strongly advises using an Entra ID application with a certificate for robust app-only access.

How do I grant admin consent for an Entra ID application?

Navigate to the Microsoft Entra admin center, select your app registration under 'App registrations', click on 'API permissions' in the sidebar, and then click the 'Grant admin consent' button. You must hold global administrator or privileged role administrator rights to perform this.

Document & File Issues