Register an Entra app for PnP

Until September 2024, PnP PowerShell used a shared Microsoft app registration called the “PnP Management Shell”. It was removed on 9 September 2024 for security reasons. Since then every organisation needs its own Entra app registration, passed in with -ClientId. Without knowing this, you get connection errors that seem to point nowhere.

What you need

Permission to create app registrations in Entra ID — typically the Cloud Application Administrator role or higher. Without it, someone else has to create the registration for you.

Registration for interactive use

For scripts you run yourself, signing in with your own account:

Code

Register-PnPEntraIDAppForInteractiveLogin -ApplicationName "PnP.PowerShell" -Tenant contoso.onmicrosoft.com -Interactive

You sign in, consent to the requested permissions, and receive a Client ID. Keep it: you need it for every connection.

Registration for unattended scripts

For scheduled tasks without a user, use app-only authentication with a certificate:

Code

Register-PnPEntraIDApp -ApplicationName "PnP.Automation" -Tenant contoso.onmicrosoft.com -Store CurrentUser -Interactive

This variant also creates a certificate, places it in your certificate store and writes a .cer and .pfx file. Upload the .cer to the app registration; your script authenticates with the .pfx.

Deliberately request fewer permissions than the default set when your script only needs a fraction of them. An automation identity with full tenant rights is a risk you rarely need to take.

Avoid typing -ClientId every time

You can set a default Client ID so existing scripts keep working unchanged. Use an environment variable ENTRAID_CLIENT_ID, or set it per tenant:

PowerShell

Set-PnPManagedAppId -Url https://contoso.sharepoint.com -AppId 00000000-0000-0000-0000-000000000000

Not sure which Client ID is being used? Add -Verbose to your Connect-PnPOnline and it will tell you.

Frequent errors and how to fix them

These are the messages people type into search when the module will not start. The exact wording is here so this page can be found.

The term 'Connect-PnPOnline' is not recognized

The module is not loaded. Install on PowerShell 7 (not 5.1), close the window, then Import-Module PnP.PowerShell.

AADSTS700016 / Application not found

The Entra app is missing or the Application (client) ID is wrong. Register your own app (required since 2024).

AADSTS65001 / consent

Admin consent is missing. In Entra: the app → API permissions → Grant admin consent.

not compatible with Windows PowerShell 5.1

Current PnP.PowerShell runs on PowerShell 7 only. Use pwsh, not powershell.exe.

PnP Management Shell / multi-tenant app retired

Since 9 Sep 2024 you must register your own Entra app. Register-PnPEntraIDApp or create it in Entra.

Access denied / Attempted to perform an unauthorized operation

The app is missing Graph or SharePoint scopes, or Sites.Selected is not granted on this site.

Please specify a valid client id for an Entra ID App Registration

Since 9 September 2024, Connect-PnPOnline only connects with your own Entra ID app. Register it once with Register-PnPEntraIDAppForInteractiveLogin and connect with -ClientId. You get the same message with an empty client ID or an app from another tenant. Step by step.

Assembly with the same name already loaded

Multiple PnP.PowerShell versions. Uninstall-Module PnP.PowerShell -AllVersions, then one version, new window.

Registering an Entra app for PnP PowerShell