[BUG] New-PnPTeamsTeam EDU_Class corrupt class-notebook

[4ndri]

Reporting an Issue or Missing Feature

creating a edu_class team with New-PnPTeamsTeam results in having a corrupt class-notebook. The class-notebook can not be initialized.

Expected behavior

Class-Team will be created and the class-notebook should be initialized without problems.

Actual behavior

Class-Team is created, but when creating the class-notebook "something" goes wrong.

Steps to reproduce behavior

• create a team with New-PnPTeamsTeam

New-PnPTeamsTeam -DisplayName "pnp-test01" -MailNickname "pnp-test01" -Owners "3c7c822e-d8a3-4237-9f3c-e18a9d1cb4ab" -Template EDU_Class

• open Microsoft Teams and create the class-notebook
  

in browser dev-tools i see this request to classnotebooks endpoint:

XHRGET
https://www.onenote.com/api/v1.0/myOrganization/groups/334cbc05-914f-47d2-985a-c04b97b75276/notes/classnotebooks/getWopiProperties(frameAction='View')
[HTTP/2 404  1332ms]

{
  "error": {
    "@api.url": "https://aka.ms/onenote-errors#C20350",
    "code": "20350",
    "displayDiagnosticInformation": true,
    "isRetriable": false,
    "message": "Cannot determine notebook type, please try again after some time."
  }
}

What is the version of the Cmdlet module you are running?

3.1.63

Which operating system/environment are you running PnP PowerShell on?

• Windows
• Linux
• MacOS
• Azure Cloud Shell
• Azure Functions
• Other : please specify

[4ndri]

A possible fix/workaround is to create the group with education/classes endpoint. This is a breaking change, additional permissions are required:

https://learn.microsoft.com/en-us/graph/api/educationclass-post?view=graph-rest-1.0&tabs=http

Permission type	Least privileged permissions	Higher privileged permissions
Delegated (work or school account)	Not supported.	Not supported.
Delegated (personal Microsoft account)	Not supported.	Not supported.
Application	EduRoster.ReadWrite.All	Not available.

Fix inside PnP-PowerShell

I created an possible fix for pnp-powershell in commit c679d9c

Workaround with PowerShell

$eduClassObject = Invoke-PnPGraphMethod -Method Post -Url "education/classes" -Content @{
	displayName  = "pnp-test-edu-class01"
	mailNickname = "pnp-test-edu-class01"
	description  = "This is a test EDU class"
} -ErrorAction Stop

$iterations = 0
$maxRetries = 12
$eduClassGroup = $null
while (-not $eduClass.id -and $iterations -lt $maxRetries) {
	try {
		$iterations = $iterations + 1
		$eduClassGroup = Get-PnPAzureADGroup -Identity $eduClassObject.id -ErrorAction Stop
	}
	catch {
		$seconds = [Math]::Min(5 * (1 -shl ($iterations - 1)), 30)
		Start-Sleep -Seconds $seconds
	}
}

if (-not $eduClassGroup.id) {
	throw "error creating EDU class team"
}
# an owner is required to create a team (add as owner and as member)
Add-PnPAzureADGroupOwner -Identity $eduClassGroup.id -Users "3501a869-454b-4758-a4ce-d694b355eca7" -ErrorAction Stop
Add-PnPAzureADGroupMember -Identity $eduClassGroup.id -Users "3501a869-454b-4758-a4ce-d694b355eca7" -ErrorAction Stop
$team = New-PnPTeamsTeam -GroupId $eduClassGroup.id -ErrorAction Stop
$team

[4ndri]

Here the info from Microsoft-Support:

"This issue is due to a change in permissions resulting from Microsoft's SFI initiatives. It is not specific to a tenant and affects all tenants. Creating teams in the previous way will not work anymore with Class Notebooks or Staff Notebooks. An article has been published which should help provide more insight into this change as well as how to fix it

Provisioning Class Notebooks and Sites at Scale Using Microsoft Graph APIs - Microsoft Support

Specifically, if you have already provisioned the sites/classes/teams, they need the specific section title shown below of the article.

take-aways

• course-teams and course-staff-teams (EDU_Class, EDU_PLC) should be created with education/classes endpoint.
• already provisioned courses can be fixed by setting the permissions (see article).

[gautamdsheth]

@4ndri - would be great if you can submit a PR for this. I don't have access to Edu tenant. It is ok if its a breaking change because looks like it is not working anyway !