[BUG] - Add-PnPApp, Get-PnPSiteCollectionAppCatalog require SharePoint Admin permission

[a1mery]

Reporting an Issue or Missing Feature

A a site admin If I try to add a .sppkg file to a site app catalog (using Add-PnPApp) I'm having an error.
It works fine if I'm SharePoint admin.
It works fine if I'm doing it from the UI interface (without being a SharePoint admin)

Expected behavior

If I'm site admin:
Add-PnPApp -Path '' -Scope Site adds my .sppkg file to the site app catalog even if I'm not SharePoint Admin
Get-PnPSiteCollectionAppCatalog -CurrentSite return a "successful" result

Actual behavior

PS C:\Windows\System32> Add-PnPApp -Path "C:\Users\adelevance\webpart.sppkg" -Scope Site
Add-PnPApp: Unable to connect to the SharePoint Online Admin Center at 'https://xxxx-admin.sharepoint.com' to run this cmdlet. If this URL is incorrect for your tenant, you can pass in the correct Admin Center URL using Connect-PnPOnline -TenantAdminUrl. If you are using Privileged Identity Management (PIM) on your tenant, please ensure you have activated at least the SharePoint Administrator role and allowed some time for it to activate. Error message: Attempted to perform an unauthorized operation.

Steps to reproduce behavior

Connect-PnPOnline -Url "Url of a site" -ClientId "xxxx-xxx"
Add-PnPApp -Path "C:\Users\adelevance\webpart.sppkg" -Scope Site

The app registration has "AllSites.FullControl" Delegated permission.

What is the version of the Cmdlet module you are running?

3.1.142

Which operating system/environment are you running PnP PowerShell on?

• Windows
• Linux
• MacOS
• Azure Cloud Shell
• Azure Functions
• Other : please specify

[jackpoz]

This might be related to the recent SharePoint Online changes where the Custom Scripts setting is reset to Blocked every 24 hours for most site templates (if not all soon) and re-enabling it requires SharePoint Online Administrator permissions.

See https://learn.microsoft.com/en-us/sharepoint/allow-or-prevent-custom-script#to-temporarily-allow-custom-script-on-sharepoint-sites and MC1117115 for more details about it.

[a1mery]

Thanks for your reply 👍
Not sure that SPFx solution deployment is impacted by this (as per my understanding).
Regardless, I've tried after enabling Custom script on the targeted site and the same error occurred 😔

[sharkk121]

I've hit this today, but on 3.1.0 which seems to have slightly different code...

In my case Add-PnPApp -Path <path> -Scope Site works fine on 2.12.0 but fails on 3.1.0.

I do not think it's reasonable to expect SharePoint Administrator permissions while deploying an app to a Site Collection App Catalog. In my case I'm deploying an app from a CICD pipeline with only Sites.Selected permissions granted for the service principal and FullControl assigned using Grant-PnPAzureADAppSitePermission.

If it were related to custom scripts being disabled, why does it work on 2.12.0?

EDIT: I think I've hit #5011 which apparently has already been fixed, just not released yet... Sorry for confusion :)