[BUG]"$allGroups = Get-PnPMicrosoft365Group" works until I add -IncludeSiteUrl

[JDwest25]

Notice

Many bugs reported are actually related to the PnP Framework which is used behind the scenes. Consider carefully where to report an issue:

Reporting an Issue or Missing Feature

#I run the following and it works:
Connect-PnPOnline -Url $theAddress -Interactive -ClientId xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
$allGroups = Get-PnPMicrosoft365Group
#when I add "-IncludeSiteUrl", I get the error that I have included in the "Actual behavior" section:
$testAllGroups = Get-PnPMicrosoft365Group -IncludeSiteUrl

Expected behavior

I expect groups to be pulled with the SiteUrl properties included.

Actual behavior

Get-PnPMicrosoft365Group: 16 error(s) occurred in a Graph batch request ({"code":"accessDenied","message":"Access denied","innerError":{"date":"2025-01-07T23:13:39","request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7","client-request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7"}}) ({"code":"accessDenied","message":"Access denied","innerError":{"date":"2025-01-07T23:13:39","request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7","client-request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7"}}) ({"code":"accessDenied","message":"Access denied","innerError":{"date":"2025-01-07T23:13:39","request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7","client-request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7"}}) ({"code":"accessDenied","message":"Access denied","innerError":{"date":"2025-01-07T23:13:39","request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7","client-request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7"}}) ({"code":"accessDenied","message":"Access denied","innerError":{"date":"2025-01-07T23:13:39","request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7","client-request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7"}}) ({"code":"accessDenied","message":"Access denied","innerError":{"date":"2025-01-07T23:13:39","request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7","client-request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7"}}) ({"code":"accessDenied","message":"Access denied","innerError":{"date":"2025-01-07T23:13:39","request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7","client-request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7"}}) ({"code":"accessDenied","message":"Access denied","innerError":{"date":"2025-01-07T23:13:39","request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7","client-request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7"}}) ({"code":"accessDenied","message":"Access denied","innerError":{"date":"2025-01-07T23:13:39","request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7","client-request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7"}}) ({"code":"accessDenied","message":"Access denied","innerError":{"date":"2025-01-07T23:13:39","request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7","client-request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7"}}) ({"code":"accessDenied","message":"Access denied","innerError":{"date":"2025-01-07T23:13:39","request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7","client-request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7"}}) ({"code":"accessDenied","message":"Access denied","innerError":{"date":"2025-01-07T23:13:39","request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7","client-request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7"}}) ({"code":"accessDenied","message":"Access denied","innerError":{"date":"2025-01-07T23:13:39","request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7","client-request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7"}}) ({"code":"accessDenied","message":"Access denied","innerError":{"date":"2025-01-07T23:13:39","request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7","client-request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7"}}) ({"code":"accessDenied","message":"Access denied","innerError":{"date":"2025-01-07T23:13:39","request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7","client-request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7"}}) ({"code":"accessDenied","message":"Access denied","innerError":{"date":"2025-01-07T23:13:39","request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7","client-request-id":"cf4ece72-4cdb-486d-86c6-3e2462cb5ab7"}})

Steps to reproduce behavior

Please include complete script or code samples in-line or linked from gists

What is the version of the Cmdlet module you are running?

Manifest 2.99.35 nightly PnP.PowerShell Desk {Add-PnPAdaptiveScopeProperty, Add-PnPE…
Manifest 2.12.16 nightly PnP.PowerShell Desk {Add-PnPAdaptiveScopeProperty, Add-PnPE…

Which operating system/environment are you running PnP PowerShell on?

• Windows (Windows 11 Pro Version 23H2)
• Linux
• MacOS
• Azure Cloud Shell
• Azure Functions
• Other : please specify

[YuriySamorodov]

Same issue

[JDwest25]

Update: If you specify just a single group, it returns a result as expected:

$groupWithSiteUrl = Get-PnPMicrosoft365Group -Identity $group.ID -IncludeSiteUrl

[erwinvanhunen]

Hi! I tried it on my end and I was able to reproduce the issue. However, the access denied message basically says what is going on: you seem to lack access to the -actual- site behind the scenes. I ran the cmdlet as you specified both with and without the -IncludeSiteUrl parameter, and for me it works without, but with I received a similar set of error messages. When checking in detail, I noticed that some of the groups in my case had a site where the account I used had no access. Granting access to those sites fixed the issue for me.

What you can do to check which sites those are in your case:

$groups = Get-PnPMicrosoft365Group
foreach($group in $groups)
{
    Write-Host "Retrieving $($group.DisplayName) $($group.Id)"
    $fullgroup = Get-PnPMicrosoft365Group -Identity $group.Id -IncludeSiteUrl
}

You will either see an error message or it will stall at the point where it cannot retrieve the group with the SiteUrl included (as it did in my case). Navigate then to the SharePoint admin center, locate the site and grant yourself the appropriate access rights (I granted myself owner rights on the site).

[erwinvanhunen]

As an update: I just merged a change that will give a somewhat more descriptive error message. Instead of just showing an access denied message, if will now also tell what call it tried to make and what went wrong. As an example this is the output it will show:

Get-PnPMicrosoft365Group: 1 error(s) occurred in a Graph batch request (An error occured for request id 16:/groups/2f8a7699-06a9-43d7-9852-96be387be347/sites/root?$select=webUrl => {"code":"accessDenied","message":"Access denied","innerError":{"date":"2025-01-10T15:23:50","request-id":"67bd1c9d-2380-49ac-81ce-e06becd1ab75","client-request-id":"67bd1c9d-2380-49ac-81ce-e06becd1ab75"}})

As the method we are using is generic behind the scenes (e.g. it is not specifically written to handle M365 Groups) we cannot provide more detail, but from the error message here you could extract the ID of the group where the access denied occured. With that information you can retrieve the actual group (Get-PnPMicrosoft365Group -Identity <groupid>) and from there you can navigate to the SP Admin Center and fix the permissions on the site for your account.

This change will be available in tomorrows nightly release (e.g. build 2.99.101)

[JDwest25]

As an update: I just merged a change that will give a somewhat more descriptive error message. Instead of just showing an access denied message, if will now also tell what call it tried to make and what went wrong. As an example this is the output it will show:

Get-PnPMicrosoft365Group: 1 error(s) occurred in a Graph batch request (An error occured for request id 16:/groups/2f8a7699-06a9-43d7-9852-96be387be347/sites/root?$select=webUrl => {"code":"accessDenied","message":"Access denied","innerError":{"date":"2025-01-10T15:23:50","request-id":"67bd1c9d-2380-49ac-81ce-e06becd1ab75","client-request-id":"67bd1c9d-2380-49ac-81ce-e06becd1ab75"}})

As the method we are using is generic behind the scenes (e.g. it is not specifically written to handle M365 Groups) we cannot provide more detail, but from the error message here you could extract the ID of the group where the access denied occured. With that information you can retrieve the actual group (Get-PnPMicrosoft365Group -Identity <groupid>) and from there you can navigate to the SP Admin Center and fix the permissions on the site for your account.

This change will be available in tomorrows nightly release (e.g. build 2.99.101)

Thank you, Erwin! I will try this with the new update and report back. For me it was strange because when I specify the group it returns a successful result (even with -IncludeSiteUrl ).