Get-PnPRetentionLabel Get-PnPTenantRetentionLabel API Permissions

[anthonywhite]

Hi, does anyone know what API permissions need to be granted to our PnP App Reg to allow Get-PnPTenantRetentionLabel command to work? I tried Graph Records Management RW All but still get prompted for Admin consent to something. @reshmee011 ?

[reshmee011]

@anthonywhite : Apologies for the late reply. This the permissions I have been prompted to admin consent

From Azure Portal the permission "RecordsManagement.Read.All" was granted.

What permissions are you being prompted? Are they same as the screenshot I provided.

[anthonywhite]

hi @reshmee011 - is this a Graph permission? The admin already tried this:

but still we get a prompt to consent...

[reshmee011]

That's all the permissions required, not sure why it's asking about the other permissions like profile. @KoenZomers , @gautamdsheth any ideas why running Get-PnPTenantRetentionLabel prompts for "View your basic profile" and "Maintain access to data you have given it access to"?

[KoenZomers]

The Get-PnPTenantRetentionLabel cmdlet calls into this Graph API behind the scenes:
https://learn.microsoft.com/en-us/graph/api/security-labelsroot-list-retentionlabel?view=graph-rest-beta&tabs=http

It only requires the delegated permission RecordsManagement.Read.All on Microsoft Graph and will not work under an application context.

The entire permission requesting and validation in PnP PowerShell I'm currently rewriting to make it much more clear which permissions are needed and which APIs are being called into. In the current latest version some stuff of that is already baked in when using -Verbose with your cmdlet execution. In the next version, there will be much more of it. Sneak preview:

[anthonywhite]

@KoenZomers @reshmee011 thanks for the replies. I will ask our admin to add that specific scope as it looks like the ReadWrite.All that we have is not matching. thx

[anthonywhite]

...and having added that scope, running with -Verbose is now showing this cryptic error message

VERBOSE: Making GET call to https://graph.microsoft.com/beta/security/labels/retentionLabels
VERBOSE: Response failed with HTTP 500 InternalServerError containing 448 characters: {"error":{"code":"UnknownError","message":"{\"ErrorCode\":\"UnknownError\",\"Message\":\"Failed to contact DataInsights in EOP - Tenant = 8ab286da-9dbb-431b-b4eb-360898848943. Exception = DataInsights command(GET) FAILED - Forbidden. TargetServer = CWXP265MB3831.GBRP265.PROD.OUTLOOK.COM\"}","innerError":{"date":"2024-10-03T08:36:42","request-id":"b2d6c671-5abd-4b49-a66a-cbfab4f2aebe","client-request-id":"b2d6c671-5abd-4b49-a66a-cbfab4f2aebe"}}}
Get-PnPTenantRetentionLabel: Internal Server Error (500): {"ErrorCode":"UnknownError","Message":"Failed to contact DataInsights in EOP - Tenant = 8ab286da-9dbb-431b-b4eb-360898848943. Exception = DataInsights command(GET) FAILED - Forbidden. TargetServer = CWXP265MB3831.GBRP265.PROD.OUTLOOK.COM"}

any ideas what might cause this?