title: PnP Powershell Sharepoint with app permissions: The remote server returned an error: (403) Forbidden
body: <p>I'd like to use PnP Powershell for provisioning modern Sharepoint Online sites by making a copy of an existing site in the tenant.  I'm running the SharePointPnPPowerShellOnline module, version 3.22.2006.2.</p>
  
  <p>If I connect using the <code>-UseWebLogin</code> option like this:</p>
  
  <p><code>Connect-PnPOnline -Url https://&lt;tenant&gt;.sharepoint.com/sites/&lt;sitename&gt; -UseWebLogin</code></p>
  
  <p>…and then run </p>
  
  <p><code>Get-PnPProvisioningTemplate -Out file.xml</code></p>
  
  <p>…then everything works fine, and I can then go on to provision a new site from the XML file that it creates.</p>
  
  <p>What I'd <strong>like</strong> to do, however, is to use Application Permissions with a Registered App in Azure AD.  I've registered an app, and given it every Sharepoint-related permission I can think of (with a view to cutting permissions back to the minimum once I've got it working).  I connect like this:</p>
  
  <p><code>connect-PnPOnline -ClientID "&lt;ClientID&gt;" -ClientSecret "&lt;ClientSecret&gt;" -url https://&lt;tenant&gt;.sharepoint.com/sites/&lt;sitename&gt;</code></p>
  
  <p>... and it appears to make the connection with no issues.  However, when I try to run the following:</p>
  
  <p><code>Get-PnPProvisioningTemplate -Out file.xml</code></p>
  
  <p>…it fails with the error:</p>
  
  <pre><code>Get-PnPProvisioningTemplate : The remote server returned an error: (403) Forbidden.
  At line:1 char:1
  + Get-PnPProvisioningTemplate
  + ~~~~~~~~~~~~~~~~~~~~~~~~~~~
      + CategoryInfo          : WriteError: (:) [Get-PnPProvisioningTemplate], WebException
      + FullyQualifiedErrorId : EXCEPTION,SharePointPnP.PowerShell.Commands.Provisioning.Site.GetProvisioningTemplate
  </code></pre>
  
  <p>The permissions I gave my Azure AD Registered App are:</p>
  
  <ul>
  <li>Microsoft Graph: Directory.ReadWrite.All </li>
  <li>Microsoft Graph: Group.Create</li>
  <li>Microsoft Graph:  Group.ReadWrite.All </li>
  <li>Microsoft Graph: Sites.FullControl.All</li>
  <li>Microsoft Graph: Sites.Manage.All </li>
  <li>Microsoft Graph: Sites.Read.All </li>
  <li>Microsoft Graph: Sites.ReadWrite.All</li>
  <li>Sharepoint: Sites.FullControl.All</li>
  <li>Sharepoint: Sites.Manage.All</li>
  <li>Sharepoint: Sites.Read.All</li>
  <li>Sharepoint: TermStore.Read.All</li>
  <li>Sharepoint: TermStore.ReadWrite.All</li>
  <li>Sharepoint: User.Read.All</li>
  <li>Sharepoint: User.ReadWrite.All</li>
  </ul>
  
  <p>I also tried creating a Sharepoint App Principal according to this article: <a href="https://www.sharepointdiary.com/2019/03/connect-pnponline-with-appid-and-appsecret.html" rel="nofollow noreferrer">https://www.sharepointdiary.com/2019/03/connect-pnponline-with-appid-and-appsecret.html</a>.  If I use the Client ID and Client Secret from this in my <code>connect-PnpOnline</code> line, again I can connect with no issues.  But again I get the same error when trying to run <code>Get-PnPProvisioningTemplate</code>.</p>
  
  <p>I've also tried connecting to a different site within the same tenant, and I get the same error with all of them.</p>
  
  <p>I'm starting to run out of ideas on this - can anyone shed some light, please?</p>