'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix Attempted to Perform an Unauthorized Operation in Invoke-PnPTenantTemplate
Question details
The user needs to resolve an unauthorized operation error that occurs when executing the Invoke-PnPTenantTemplate cmdlet in PnP PowerShell.
- Product
- SharePoint Online PnP PowerShell
- Device & OS
- not provided
- Scenario
- Applying a tenant template to SharePoint Online using the Invoke-PnPTenantTemplate command.
- Observed behavior
- The system throws an 'Attempted to perform an unauthorized operation' error and fails to apply the tenant template.
Ensure you have Global Administrator or SharePoint Administrator privileges in your Microsoft 365 tenant before executing tenant-level PnP PowerShell scripts. Verify that you are running the latest version of the PnP PowerShell module.
Verify Entra ID App Permissions and Admin Consent
Use this solution to ensure your Azure AD (Entra ID) application has the correct API permissions granted and consented to for tenant-level provisioning.
Tenant-level operations in PnP PowerShell typically require specific Microsoft Graph and SharePoint permissions configured via an Entra ID app registration.
Log in to the Microsoft Entra admin center and navigate to 'App registrations' to locate the custom app used for your PnP PowerShell connection.
Click on 'API permissions' and verify that you have added the required SharePoint and Microsoft Graph permissions for tenant operations (e.g., Sites.FullControl.All).
Click the 'Grant admin consent for [Your Tenant]' button to ensure all requested permissions are authorized at the tenant level.
Run the Connect-PnPOnline cmdlet again, specifying your ClientId, Tenant, and Certificate/Thumbprint to re-authenticate with the newly granted permissions.
Seek Assistance in the SharePoint Developer Community
If permissions are configured correctly but the error persists, the issue may involve a bug or specific tenant-level limitation requiring expert help.
Enhance Your Daily Productivity with WPS Office
While SharePoint and PowerShell require complex administrative troubleshooting, your daily document management shouldn't. WPS Office provides a free, lightweight, and powerful alternative to Microsoft Office, allowing you to easily handle standard documents, spreadsheets, and presentations without subscription hassles.
- 1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install the Software: Run the downloaded installer and follow the simple on-screen instructions to complete the setup.
- 3. Open Your Files: Launch WPS Office and directly open your existing Word, Excel, or PowerPoint files to start working immediately.
Frequently Asked Questions
Why does Invoke-PnPTenantTemplate require special administrative permissions?
This command modifies resources at the tenant level, which can include creating site collections, applying global themes, or modifying security settings. These actions strictly require elevated privileges such as the SharePoint Administrator or Global Administrator roles.
Can I use interactive login with Invoke-PnPTenantTemplate?
While interactive login can work for standard site operations, tenant-level templates and provisioning heavily rely on Azure AD (Entra ID) app registrations using certificate-based authentication to ensure secure and authorized access.
How do I update my PnP PowerShell module?
Open a PowerShell window as an Administrator and run 'Update-Module -Name PnP.PowerShell' to install the latest version, which may contain critical bug fixes for unauthorized operation errors.
