PNP Connection Failure with Custom App Registration + non-onmicrosoft UPN

[amitmtank]

Probably a specific scenario but wanted to report the finding here.

• Custom Aapp registration for Microsoft Graph PowerShell with Delegation access and using it for M365DSC exports.
• Using on-prem synced cloud admin account that has UPN in different format than contoso.onmicrosoft.com.

Failing with below error:

`[WARNING] We recommend providing the username in the format of .onmicrosoft.* for the Credential property.
Exporting Microsoft 365 configuration for Components: ODSettings, SPOApp, SPOBrowserIdleSignout, SPOHomeSite, SPOHubSite, SPOOrgAssetsLibrary, SPOSearchManagedProperty, SPOSearchResultSource, SPOSiteDesign, SPOSiteDesignRights, SPOSiteScript, SPOStorageEntity, SPOTenantCdnEnabled, SPOTenantCdnPolicy, SPOTheme

Authentication methods specified:

• CredentialsWithApplicationId

Connecting to {PnP}...❌
TenantId must be in format contoso.onmicrosoft.com`

[andikrueger]

Thanks for reporting this scenario.

The parameter validation was recently introduced in M365DSC. MSCloudLoginAssistant should continue to work as before.

The warning tells you about possible issues with usernames that do not end on .onmicrosoft..

The real issue here would be the tenant Id. This one needs to be provided as .onmicrosoft.* Could you verify this to not be the GUID of your tenant?

[amitmtank]

Thanks for the response Andi!

Agree, real issue could be TenantID here (which would be potentially being constructed from the userID/UPN that is not in the onmicrosoft format?).

If I include the -TenantID parameter with "contoso.onmicrosoft.com" formatted value in Export-M365DSCConfiguration cmdlet along with -ApplicationID then it thinks that I am using ServicePrincipal auth method instead of Cred+AppID and throws below error.

[ERROR] You have to specify ApplicationSecret, CertificateThumbprint or CertificatePath when you specify ApplicationId/TenantId

[andikrueger]

Does this work with plain MSCloudLoginAssistant?

$cred = Get-Credential
Connect-M365Tenant -Workload PnP -Credential $cred -TenantId "<TheOtherTenant>.onmicrosoft.com"

If yes, we should move this issue to the M365DSC repo.