Issue running invoke-pronounsync.psq

[MschnyderISDSI]

Hello,
I've run everything up to the invoke script. The pronoun field shows up in SharePoint custom properties, I confirmed the app and API permissions were set.
When I run the script I get the below error for every user. Can anyone help?

Get-PnPUserProfileProperty : Attempted to perform an unauthorized operation.
At E:\Invoke-PronounSync.ps1:48 char:20

• ... $pnpUser = Get-PnPUserProfileProperty -Account $aadUser.UserPrincipa ...

•             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : WriteError: (:) [Get-PnPUserProfileProperty], ServerUnauthorizedAccessException
  • FullyQualifiedErrorId : EXCEPTION,PnP.PowerShell.Commands.UserProfiles.GetUserProfileProperty

Thanks

[merill]

Looks like a permission issue. Do you have access to the SharePoint tenant admin?

See https://pnp.github.io/powershell/cmdlets/Get-PnPUserProfileProperty.html

[MschnyderISDSI]

Hi Merill,
That's what everything points to. I'm a global/Sharepoint admin and can open the SharePoint admin site.

[curthendzell-lbbs]

In the same boat here. Same error, same global/SP admin permissions.

[jrollmann]

So I was getting the issue that @MschnyderISDSI and @curthendzell-lbbs. I was able to get past that after running the Connect-PnPOnline -Url 'https://tenantadmin-admin.sharepoint.com' -Interactive

But now when it runs and catches someone who updated their Pronoun

Invoke-RestMethod : The remote server returned an error: (400) Bad Request.
+     $res = Invoke-RestMethod -Headers @{Authorization = "Bearer $acce ...
+            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebExc
   eption
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand

[jjmbrooks80RM]

So, I've tried to run the Invoke-pronunsync powershell, but it's still coming back Get-PnPUserProfileProperty : Attempted to perform an unauthorized operation.
I've got Sharepoint Admin access, as well as global 365 admin rights on the same account. Everything else seems to have worked okay
I even tried following what jrollmann suggested, using the connect-pnponline first, but still errored out

[merill]

Are you connecting to the nnnnn-admin.sharepoint.com site when calling Connect-PnPOnline?

[jjmbrooks80RM]

Are you connecting to the nnnnn-admin.sharepoint.com site when calling Connect-PnPOnline?

Yes, and it connects fine

[merill]

Does this happen with all users or just some?

BTW Are your users synced from on-prem AD or are these cloud users?

[jjmbrooks80RM]

Hi, this happens with all users, and they are sync’d from on-prem.

[merill]

Ah, got it. So the script to update the extension attribute in Azure AD will only work for cloud users. If your users are synced from on-prem you will need to tweak the script to make it update Active Directory.

Set-ADUser –Identity $ThisUser -add @{"extensionattribute1"="MyString"}

[jjmbrooks80RM]

Ah, got it. So the script to update the extension attribute in Azure AD will only work for cloud users. If your users are synced from on-prem you will need to tweak the script to make it update Active Directory.

Set-ADUser –Identity $ThisUser -add @{"extensionattribute1"="MyString"}

Hi,

Sorry, to ask a silly question, but where abouts in the invoke script does this need adding?

Cheers

[merill]

You can comment out lines 54-59 (which updates AAD) and instead use the Set-ADUser.

[jjmbrooks80RM]

Hi, Sorry I’m being a pain now. I’ve tried to change the code but it still wasn’t running correctly, hence the attached file. Just wondering, if you could take a look, and advise where I’m going wrong. Thanks Jeremy Brooks [Invoke-PronounSync - Copy.txt](https://github.com/merill/m365-gender-pronoun-kit/files/9072600/Invoke-PronounSync.-.Copy.txt)

[BobThompsonLV]

Hi. I am also getting errors when running invoke-pronounsync. I ran Powershell ISE as Admin using on-prem domain admin account and elevated my Azure role to Global Admin. I have verified the app permissions in Azure Enterprise Apps. On initial run, I received this error for every user:
Get-PnPUserProfileProperty : Attempted to perform an unauthorized operation.
Invoke-PronounSync.ps1:48 char:20

• ... $pnpUser = Get-PnPUserProfileProperty -Account $aadUser.UserPrincipa ...
• CategoryInfo : WriteError: (:) [Get-PnPUserProfileProperty], ServerUnauthorizedAccessException

I thought that odd because a "get" operation should not be trying to write anything, but following advise in the above thread I ran connect-pnponline -interactive.

I am now getting the above error for every user, and for some users I am also getting:
Invoke-RestMethod : The remote server returned an error: (400) Bad Request.
Invoke-PronounSync.ps1:32 char:12

• $res = Invoke-RestMethod -Headers @{Authorization = "Bearer $acce ...
  

• CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebException

My users are on-prem and sync'd to Azure, so I tried adjusting the script as indicated above. However, I'm getting the same result. Any help or direction on this would be much appreciated!