Make a report

[nicole-ge]

Hi guys,

I try to make a report to see which user with which user type, country, location have permissions on each site collection of my tenant.

I tried to do something like this:

#connection via app registration and certificate
Connect-PnPOnline -Url $adminSiteUrl -ClientId $clientId -Thumbprint $Thumbprint -Tenant "$tenantid

$sites = Get-PnPTenantSite

Foreach ($site in $sites) {

Connect-PnPOnline -Url $site -ClientId $clientId -Thumbprint $Thumbprint -Tenant "$tenantid

$users = Get-PnPUser

Foreach ($user in $users) {
$azureADUser = Get-PnPAzureADUser -Identity $user.LoginName -Select "Country", "UserType"

$guests += $azureADUser | Where-Object UserType -eq "Guest"
}

}

What I am doing, with the cmdlet Get-PnPAzureADUser I retrieve no values?

Thanks for your help

[nicole-ge]

Hi @martinlingstuyl ,

Maybe you can help me in this question, because when I iterate through a lot spo sites the cmdlet Get-PnPAzureADUser didn't filter the user and I don't retrieve any information when I use to select or filter in combination with this cmdlet Get-PnPAzureADUser.

Thank you very much 😊

[martinlingstuyl]

Hi @nicole-ge,

I believe this is because the format of the LoginName is not usable in the Get-PnPAzureADUser commandlet.

The format of the LoginName coming from Get-PnPUser is i:0#.f|membership|[email protected]. If you strip off the i:0#.f|membership| part it will work:

# This works
Get-PnPEntraIDUser -Identity "[email protected]"

# This does not
Get-PnPEntraIDUser -Identity "i:0#.f|membership|[email protected]"

I'm using Get-PnPEntraIDUser, as Get-PnPAzureADUser is the older alias

🚀 Have a great day!

[martinlingstuyl]

(Don't forget to mark this thread as answered if you found this helped you 😉)

[nicole-ge]

Hi @martinlingstuyl

I will try this and let you know :)
Thank you very much

[nicole-ge]

Hi @martinlingstuyl

It is not working. I got the following error: the provided value for scope user.read.all is not valid. Client credentials flows must have a scope value with /.default ....

What can I do now?

Kind regards
Nicole

[martinlingstuyl]

Hi @nicole-ge, .default is not a scope, that's just saying you want all app only permission scopes available for the resource.

So if you have the user.read.all app only permission scope configured on your application, you should be good to go, and using https:/graph.microsoft.cpm/.default will get you a graph token with that user scope

So the question is: do you have the correct scope on your app?

[nicole-ge]

Hi @martinlingstuyl

I have :

Microsoft Graph
User.read.all (delegated and application)

SHAREPOINT
User.read.all ( application)

Kind regards
Nicole

[martinlingstuyl]

That should be good for the get-pnpazureaduser command

Do you have a screenshot of the error and your script?

[nicole-ge]

Hi @martinlingstuyl

I think there is an issue with the cmdlet
See the bug
#4258

I will try the nightly update of pnp

And send you my script

[martinlingstuyl]

Ah, that's seems to be a bug indeed. I'm using the nightly, which was why I didn't get the error...

I assume this has resolved it for you as well?

[nicole-ge]

hi @martinlingstuyl ,

here is my script and don't know why it doesn't work. can you please help me:

---

$Sites = Get-PnPTenantSite

Write-Output $Sites.Count

#Iterate through each site collection
ForEach($Site in $Sites)
{
# Connect to SharePoint Online using the certificate
Connect-PnPOnline -Url $Site.Url -ClientId $ApplicationId -CertificatePath $certificatePath -Tenant $TenantId -CertificatePassword $certificatePasswordSecure

$users = Get-PnPUser
 
$usersCountry = @()

ForEach($user in $users)
{
    $azureADUser = Get-PnPAzureADUser -Identity $user.Email -Select "Country", "UserType"
    $usersCountry += $azureADUser | Where-Object $_.AdditionalProperties.Country -eq "Germany"

         
}

#"User from specific country"
if ($usersCountry.Count -ge 1) { $userCountry = "Yes" } else { $userCountry = "No"}

$csvliste += [pscustomobject]@{
    "Site" = $Site.Url
    "User from specific country" = $userCountry
}

}

[martinlingstuyl]

HI @nicole-ge, what exactly doesn't work? What errors do you get?

Off the top of my head: I'd check if $user.Email actually contains a value. It may be null, in which case you may need to load it using CSOM, or use $user.LogonName and split it so that you only get the UPN.

[nicole-ge]

hi @martinlingstuyl
$_.AdditionalProperties.Country this property is not filled out
how I correctly call it?

[martinlingstuyl]

Hi @nicole-ge, ah wait, forget CSOM, this is a Graph commandlet. You may check if using the -Select option gives you something:

$user = Get-PnPAzureADUser -Identity adelev@contoso.com -Select "Country"

[nicole-ge]

Hello @martinlingstuyl

thank you very much for your help
to get the values afterwards I need:
$user = Get-PnPAzureADUser -Identity [email protected] -Select "Country", "UserType" -->works only with email

these are the right properties to call
$user.AdditionalProperties.country
$user.AdditionalProperties.usertype