Grant-PnPAzureADAppSitePermission does not work when setting read permission to personal site

Question

Grant-PnPAzureADAppSitePermission does not work when setting read permission to personal site

Melvin 80

Hi,

Is it expected that the PowerShell command Grant-PnPAzureADAppSitePermission does not work when granting read access to a personal OneDrive site (-my.sharepoint.com)? When I tried running this command:

Grant-PnPAzureADAppSitePermission -AppId <APP_ID> -DisplayName <DISPLAY_NAME> -Permissions Read -Site https://<acccount_name>-my.sharepoint.com/personal/<SITE NAME>

I keep getting this error:

Grant-PnPAzureADAppSitePermission: {"error":{"code":"accessDenied","message":"Access denied","innerError":{"date":"2025-12-16T23:12:59","request-id":"...","client-request-id":"..."}}}

When I run it on a regular SharePoint site, it works fine.

Here's the permission's I set on the client I used to log in with Connect-PnPOnline

User's image

Can you please advise? Thanks!

0 comments

Answer accepted by question author

Anonymous

Hi Melvin,

Welcome to Microsoft Q&A Forum! Have a good day and I hope you're doing well!

Thank you for bringing this up. I understand how confusing and unexpected it can be when a PnP command works fine on standard SharePoint sites but fails on a personal OneDrive site. To better support your case, I performed additional research and ran several tests in my own environment to reproduce your scenario.

Below are the insights from my testing that I hope will help clarify the situation.

1. I successfully reproduced your scenario and the Read permission worked in my test environment

To verify the behavior, I executed the same command:

Grant-PnPAzureADAppSitePermission -AppId <APP_ID> -DisplayName <DISPLAY_NAME> -Permissions Read -Site https://<tenant>-my.sharepoint.com/personal/<SITE NAME>

The command completed successfully on my personal OneDrive test site. I did not receive the accessDenied error.

Here is the output from my test environment confirming that the permission was granted: User's image

2. Permissions configured on my Azure AD application

These were the exact permissions assigned on the Azure AD application I used for testing: User's image

I recommend double-checking that your app’s permissions match.

3. Connect-PnPOnline must target the my.sharepoint.com endpoint

One detail that can cause this exact issue is connecting PnP to the wrong endpoint.

For OneDrive personal sites, PnP must connect to:

https://<tenant>-my.sharepoint.com

If you connect to:

https://<tenant>-admin.sharepoint.com

the operation may fail because it is pointing to the admin site collection, not the personal OneDrive site.

If you are currently connected to the admin endpoint, please disconnect first and reconnect to the correct OneDrive URL.

Here is the exact connection command I used: User's image

I hope the testing results and insights shared above help shed more light on the issue you're facing. Thank you again for your cooperation. I truly appreciate the effort you’ve put into troubleshooting this. If you have any questions, concerns, or if anything I said is unclear, please feel free to let me know.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Melvin 80 Reputation points

2025-12-18T00:42:43.96+00:00

Hi,

It works if I try to set permission on my own personal OneDrive site. But if I try it on a site that I do not own it does not work. Can you check if you can do it on a different person's OneDrive site?
Anonymous

2025-12-18T05:54:56.93+00:00
Hi Melvin,

Thanks for your response! As you can see in the screenshot I shared earlier, I was able to assign Read permissions to two different personal OneDrive sites. One is my own OneDrive, and the other belongs to another user in my tenant. Both permission assignments were successful on my side.

For transparency, I ran all PnP PowerShell commands as a Global Administrator and with Site Collection Administrator rights on the target OneDrive. This part is important because PnP can only grant permissions if the caller is a Site Collection Admin of that personal OneDrive.

Here’s how you can become Site Collection Administrator for someone else’s OneDrive:

Go to Microsoft 365 Admin Center

Open Active Users

Select the user whose OneDrive you want to access

Go to the OneDrive tab

Click Create link to files (or Get access to files)

Microsoft will automatically add you to the Site Collection Administrators group of that OneDrive.

After that, double‑check the permission inside the OneDrive settings:

Open the user’s OneDrive

Click the Settings (gear icon)

Go to OneDrive Settings > More settings

Verify that your account is listed under Site Collection Administrators (If not, you can add yourself manually)

This is the permission level I used when running the PnP command, and I hope these details give you additional insight into why it may behave differently depending on access level.

Please let me know how it goes on your side. I’m happy to continue assisting!
Melvin 80 Reputation points

2025-12-18T17:50:34.25+00:00

Hi,

Does that mean if I have to set permissions to 100 OneDrive sites, I have to become Site Collection Administrator for all 100 OneDrive sites, meaning I have to do the above steps 100 times?

Thanks.
Anonymous

2025-12-18T23:49:47.6333333+00:00

Hi Melvin,

Based on my research and testing, it’s important to note that personal OneDrive sites (/personal/...) are handled as individual site collections per user and are protected by an additional security layer to safeguard personal data. As a result, even a Global Administrator does not automatically have site‑level access to all OneDrive sites. PnP can only grant site‑level app permissions when the caller is a Site Collection Administrator of the specific OneDrive.

With the current PnP / site‑level permission approach, each OneDrive needs to be configured independently (for example, multiple OneDrive sites would require multiple site‑collection‑level permission assignments).

As mentioned earlier, using Create link to files (Get access to files) helps because Microsoft will automatically assign Site Collection Administrator permissions, which can reduce manual effort.

Hope these insights are helpful.
Anonymous

2025-12-22T00:58:54.5366667+00:00

Hi Melvin,

Have a great day! I wanted to follow up and confirm whether the details I shared and the testing results helped clarify the behavior you’re experiencing, or at least moved things a bit closer to an explanation.

If you still have any questions or concerns, please don’t hesitate to reach out anytime. Thanks for your understanding and support!
Anonymous

2025-12-24T10:47:23.69+00:00

Hi Melvin,

We’d love to hear back from you whenever you're ready.

If there’s any update, please don’t hesitate to let us know.

1 additional answer

Your answer

Melvin 80 Reputation points

2025-12-18T00:42:43.96+00:00

Hi,

It works if I try to set permission on my own personal OneDrive site. But if I try it on a site that I do not own it does not work. Can you check if you can do it on a different person's OneDrive site?
Anonymous

2025-12-18T05:54:56.93+00:00

Hi Melvin,

Thanks for your response! As you can see in the screenshot I shared earlier, I was able to assign Read permissions to two different personal OneDrive sites. One is my own OneDrive, and the other belongs to another user in my tenant. Both permission assignments were successful on my side.

For transparency, I ran all PnP PowerShell commands as a Global Administrator and with Site Collection Administrator rights on the target OneDrive. This part is important because PnP can only grant permissions if the caller is a Site Collection Admin of that personal OneDrive.

Here’s how you can become Site Collection Administrator for someone else’s OneDrive:

Go to Microsoft 365 Admin Center

Open Active Users

Select the user whose OneDrive you want to access

Go to the OneDrive tab

Click Create link to files (or Get access to files)

Microsoft will automatically add you to the Site Collection Administrators group of that OneDrive.

After that, double‑check the permission inside the OneDrive settings:

Open the user’s OneDrive

Click the Settings (gear icon)

Go to OneDrive Settings > More settings

Verify that your account is listed under Site Collection Administrators (If not, you can add yourself manually)

This is the permission level I used when running the PnP command, and I hope these details give you additional insight into why it may behave differently depending on access level.

Please let me know how it goes on your side. I’m happy to continue assisting!
Melvin 80 Reputation points

2025-12-18T17:50:34.25+00:00

Hi,

Does that mean if I have to set permissions to 100 OneDrive sites, I have to become Site Collection Administrator for all 100 OneDrive sites, meaning I have to do the above steps 100 times?

Thanks.
Anonymous

2025-12-18T23:49:47.6333333+00:00

Hi Melvin,

Based on my research and testing, it’s important to note that personal OneDrive sites (/personal/...) are handled as individual site collections per user and are protected by an additional security layer to safeguard personal data. As a result, even a Global Administrator does not automatically have site‑level access to all OneDrive sites. PnP can only grant site‑level app permissions when the caller is a Site Collection Administrator of the specific OneDrive.

With the current PnP / site‑level permission approach, each OneDrive needs to be configured independently (for example, multiple OneDrive sites would require multiple site‑collection‑level permission assignments).

As mentioned earlier, using Create link to files (Get access to files) helps because Microsoft will automatically assign Site Collection Administrator permissions, which can reduce manual effort.

Hope these insights are helpful.
Anonymous

2025-12-22T00:58:54.5366667+00:00

Hi Melvin,

Have a great day! I wanted to follow up and confirm whether the details I shared and the testing results helped clarify the behavior you’re experiencing, or at least moved things a bit closer to an explanation.

If you still have any questions or concerns, please don’t hesitate to reach out anytime. Thanks for your understanding and support!
Anonymous

2025-12-24T10:47:23.69+00:00

Hi Melvin,

We’d love to hear back from you whenever you're ready.

If there’s any update, please don’t hesitate to let us know.

Answer 1

Melvin 80

Hi,

Does that mean if I have to set permissions to 100 OneDrive sites, I have to become Site Collection Administrator for all 100 OneDrive sites, meaning I have to do the above steps 100 times?

Thanks.

Westley Hall 0 Reputation points

2026-08-01T00:43:03.8066667+00:00

Yes, that is required. There is a setting to add people automatically to each onedrive's permissions, but it must be set before the site is created here-
https://{tenantName}-admin.sharepoint.com/_layouts/15/Online/PersonalSites.aspx?PersonalSitesOverridden=1
Under the 'Secondary Admin' setting.