Connect-PnPOnline from Azure App and Runbook

Question

we have an Azure App Registration and run a PowerShell-Script from a Azure RunBook to sync users from AAD to SharePoint User Profile Store. The App has approved consent to read users by graph from aad and read/write to SharePoint User-Profiles:

The PowerShell-Script connects to graph and pnponline by App which is working fine.

$serviePrincipalName = 'ZZZ-SPOScript'
$servicePrincipalConnection=Get-AutomationConnection -Name $serviePrincipalName   
Connect-MgGraph -TenantId $servicePrincipalConnection.TenantId -ClientId $servicePrincipalConnection.ApplicationID -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint 
Connect-PnPOnline -Url "https://ourtenant-admin.sharepoint.com" -Tenant $servicePrincipalConnection.TenantId -ClientId $servicePrincipalConnection.ApplicationID -Thumbprint $servicePrincipalConnection.CertificateThumbprint

We can get all users from aad:

$users = Get-MgUser -All -Property "Id,mail,UserPrincipalName,extension_b8fc35d8e8ec45e689d332303177957a_ZZZ_townCode,extension_b8fc35d8e8ec45e689d332303177957a_ZZZ_costNumber,extension_b8fc35d8e8ec45e689d332303177957a_employeeID,extension_b8fc35d8e8ec45e689d332303177957a_employeeNumber,extension_b8fc35d8e8ec45e689d332303177957a_ZZZ_title,extension_b8fc35d8e8ec45e689d332303177957a_ZZZ_office,extension_b8fc35d8e8ec45e689d332303177957a_extensionAttribute6,extension_b8fc35d8e8ec45e689d332303177957a_extensionAttribute7"

We iterate over all users:

foreach($user in $users) {...

But when we try to get the user profile properties from SharePoint by calling

$fldValue = (Get-PnPUserProfileProperty -Account $user.UserPrincipalName).UserProfileProperties."ZZZ-CostNumber";

we get Current user is not a tenant administrator.

Our Service Principal ZZZ-SPOScript which runs the Script within the RunBook is of course not a tenant admin (and will never be).

So, we added an App Permission entry for the Azure App Registration by /_layouts/15/AppInv.aspx

with following Permissions to elevate to FullControl

<AppPermissionRequests>
<AppPermissionRequest Scope="http://sharepoint/content/tenant" Right="FullControl" />
</AppPermissionRequests>

But still we get Current user is not a tenant administrator. if the Scripts is trying to call Get-PnPUserProfileProperty

Are we missing something or can this be a bug in pnponline?

Additional finding: As stated here we should add Full Control permissions for the social features. So, I upated the permissions to

<AppPermissionRequests AllowAppOnlyPolicy="true">
<AppPermissionRequest Scope="http://sharepoint/content/tenant" Right="FullControl" />
<AppPermissionRequest Scope="http://sharepoint/social/tenant" Right="FullControl" />

But still same error.

Answer 1

Looks like there is simply a typo in the very first string:

$serviePrincipalName = 'ZZZ-SPOScript'

The correct one should be

$servicePrincipalName = 'ZZZ-SPOScript'