Set-PnpTenantSite bug? 'Field or property "AuthContextStrength" does not exist.'

[DavidB1987]

Hello,

PnP.Powershell 1.7.0

Earlier today I tried to update the ConditionalAccessPolicy of a SPO teamsite to use AuthenticationContext with the command Set-SPOSite -Identity site url -ConditionalAccessPolicy AuthenticationContext -AuthenticationContextName "name" from the SharePointOnlinePowershell module.
There I got the error: Set-SPOSite : Field or property "AuthContextStrength" does not exist.

Alternatively tried again with the command Set-PnpTenantSite -Identity "site url" -ConditionalAccessPolicy AuthenticationContext -Title "name"
(as I did not find the '-AuthenticationContextName' parameter like in the SharePointOnlinePowershell module, '-Title' is most likely wrong, but)
There I got the same error: Set-PnpTenantSite : Field or property "AuthContextStrength" does not exist.
Powershell did suggest the parameters "-ConditionalAccessPolicy" and the following "AuthenticationContext", but it seems it's not documented? https://docs.microsoft.com/en-us/powershell/module/sharepoint-pnp/set-pnptenantsite?view=sharepoint-ps

Is this some 'leftover' from an old version of the PnP.Powershell module of is 1.7.0 incomplete in some way?

[dbroussa]

I am getting a similar error when I am trying to update OneDrive site collections to set the ConditionalAccessPolicy to BlockAccess. Example code:

Connect-SPOService -url https://tenant-admin.sharepoint.com

foreach($od4B in Get-SPOSite -Template "SPSPERS" -Limit All -IncludePersonalSite $True)
{
if ($od4B.ConditionalAccessPolicy -ne 'BlockAccess')
{
Set-SPOSite -ConditionalAccessPolicy "BlockAccess" -Identity $od4B.url
}
}

When I execute this I get the following error:

Set-SPOSite : Field or property "AuthContextStrength" does not exist.
At line:7 char:9

•     Set-SPOSite -ConditionalAccessPolicy "BlockAccess" -Identity  ...
  

•     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [Set-SPOSite], ServerException
  • FullyQualifiedErrorId : Microsoft.SharePoint.Client.ServerException,Microsoft.Online.SharePoint.PowerShell.SetSite

[DavidB1987]

Microsoft confirmed this is a bug. I have not yet had time to test the work around they suggest.

I quote their mail:

We have checked your issue with our internal team and they updated that this is a known issue globally and they are proactively working on it to get it resolved however there is no specific ETA for it but will be fixed soon. However they have shared workaround for this issue as referred below.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Workaround:
Customers trying to set ConditionalAccessPolicy with Set-SPOSite can use the following PnP script as workaround. (if PnP module is updated, the second Get-PnPTenantSite cmdlet is needed or else it may not set the change.

Connect-PnPOnline -Url [https://%3ctenant%3e.sharepoint.com]https://.sharepoint.com
$site = Get-PnPTenantSite -Url "https://.sharepoint.com/sites/"
$site.ConditionalAccessPolicy = [Microsoft.Online.SharePoint.TenantManagement.SPOConditionalAccessPolicyType]::AllowFullAccess
$site.Update()
Invoke-PnPQuery
Get-PnPTenantSite -Url "https://.sharepoint.com/sites/"

Setting up PnP:
• Run Powershell as Administrator
• Uninstall-Module -Name PNP.Powershell -Force
• Close Powershell
• Run Powershell as Administrator
• Get-InstalledModule [to confirm PNP.powershell is uninstalled]
• Install-Module -Name SharePointPnPPowerShellOnline
• Get-InstalledModule [to confirm it is installed]
3.29.2101.0 SharePointPnPPowerShellOnline PSGallery Microsoft 365 Patterns and Practices
• Connect-PnPOnline -Url

For customers who are trying to use Set-SPOSite to configure AuthenticationContextName (public preview feature), they cannot set it via PowerShell. The workaround is use sensitivity label:
https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels-teams-groups-sites?view=o365-worldwide#:~:text=%20Use%20PowerShell%20to%20apply%20a%20sensitivity%20label,as%20a%20variable.%20For%20example:PowerShell%24Id%20%3D...%20More

[dbroussa]

The problem with that work around is that it only works for Modern M365 Groups. In our situation we want to apply this to OneDrive site collections. and thus this won't work. We used to be able to do this. I wonder if we should try doing this at the tenant level instead.

[DavidB1987]

This is my reply to Microsoft, including a solution (workaround) that worked for me, though if you try the same, be carefull deleting modules - check if your other scripts still work (I had to revert the changes I made myself).
I did get feedback it will be fixed soon as the internal team is proactively working on it.
I don't know if it (the fix) will be for both the PnP.Powershell and Microsoft.Online.SharePoint.Powershell module or only one.
I'll keep you updated if I get more feedback

"
This workaround does not work. It only supports ‘AllowFullAccess’,’AllowLimitedAccess’ and ‘BlockAccess’. https://docs.microsoft.com/en-us/previous-versions/office/sharepoint-csom/mt813310(v=office.15)

However, I found the solution!

The cause of the problem was that the Set-SPOsite command with the same properties is available in the Powershell module Microsoft.Online.SharePoint.Powershell and the Powershell module SharePointPnPPowerShellOnline

I used the Microsoft.Online.SharePoint.Powershell module when I got the error I reported.

After removing that module and installing the old Powershell module SharePointPnPPowerShellOnline the command executed successfully.

This old module comes with a warning that it wil be archived soon and my scripts are already updated to use the modern PnP.Powershell and/or Microsoft.Online.SharePoint.Powershell modules,
so I hope this gets fixed and implemented the Microsoft.Online.SharePoint.Powershell module and/or in the PnP.Powershell module soon.
"

edit I removed the Microsoft.Online.SharePoint.Powershell module, though I could propably just have explicitly refered the commands to the SharePointPnPPowerShellOnline module in stead

[DavidB1987]

Update from the technical lead @ Microsoft:
I would like to inform you that we have checked with the escalations and we found its a known issue and PG Team has already deployed the fix to all the Tenants which will be completed 100% by This Monday 23rd August 2021.

I would request you to please wait until this weekend and it should be resolved for your Tenant also.