Invoke-PnPSiteTemplate throws Access denied error on SiteSettings

Expected behavior Execute without issue

Actual behavior Invokes the site template correctly, except for site settings. The quick navigation is not provisioned successfully.

If I add the following switch to Get-PnPSiteTemplate and Invoke-PnPSiteTemplate, the site template succeeds: -ExcludeHandlers SiteSettings. I need to add the quick launch manually afterwards.

Steps to reproduce behavior

$connection = Connect-PnPOnline -Url $url -Credentials $credPnP -ReturnConnection -ErrorAction Stop 
$siteConnection = Connect-PnPOnline -Url $siteUrl -Credentials $credPnP -ReturnConnection -ErrorAction Stop 
Get-PnPSiteTemplate -Connection $connection -Out $templateXmlName -IncludeAllPages -PersistBrandingFiles -Force
Invoke-PnPSiteTemplate -Connection $siteConnection -Path $templateXmlName -IgnoreDuplicateDataRowErrors -OverwriteSystemPropertyBagValues -ClearNavigation 

Invoke-PnPSiteTemplate: Access denied. You do not have permission to perform this action or access this resource. Full exception below.

What is the version of the Cmdlet module you are running? PnP.PowerShell version 1.5.0

Which operating system/environment are you running PnP PowerShell on? Errors are received locally as well as in Azure RunBook / Azure Function

Exception In Dutch, apologies, but it says “Access Denied”. It looks like it’s on the check for feature activation; nevertheless, the features are properly activated.

Message          : Toegang geweigerd. U bent niet gemachtigd om deze bewerking uit te voeren of deze bron te openen.
Stacktrace       :    bij Microsoft.SharePoint.Client.ClientRequest.ProcessResponseStream(Stream responseStream)
                      bij Microsoft.SharePoint.Client.ClientRequest.ProcessResponse()
                      bij Microsoft.SharePoint.Client.ClientRequest.<ExecuteQueryToServerAsync>d__53.MoveNext()
                   --- Einde van stacktracering vanaf vorige locatie waar uitzondering is opgetreden ---
                      bij System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                      bij System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task
                   )
                      bij Microsoft.SharePoint.Client.ClientRequest.<ExecuteQueryAsync>d__39.MoveNext()
                   --- Einde van stacktracering vanaf vorige locatie waar uitzondering is opgetreden ---
                      bij System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                      bij System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task
                   )
                      bij Microsoft.SharePoint.Client.ClientRuntimeContext.<ExecuteQueryAsync>d__65.MoveNext()
                   --- Einde van stacktracering vanaf vorige locatie waar uitzondering is opgetreden ---
                      bij System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                      bij System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task
                   )
                      bij Microsoft.SharePoint.Client.ClientContext.<ExecuteQueryAsync>d__28.MoveNext()
                   --- Einde van stacktracering vanaf vorige locatie waar uitzondering is opgetreden ---
                      bij System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                      bij Microsoft.SharePoint.Client.ClientContextExtensions.<ExecuteQueryImplementation>d__6.MoveNext
                   ()
                   --- Einde van stacktracering vanaf vorige locatie waar uitzondering is opgetreden ---
                      bij System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                      bij System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task
                   )
                      bij Microsoft.SharePoint.Client.FeatureExtensions.<IsFeatureActiveInternal>d__12.MoveNext()
                   --- Einde van stacktracering vanaf vorige locatie waar uitzondering is opgetreden ---
                      bij System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
                      bij System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task
                   )
                      bij Microsoft.SharePoint.Client.FeatureExtensions.IsFeatureActive(Web web, Guid featureID)
                      bij Microsoft.SharePoint.Client.SiteExtensions.IsCommunicationSite(Site site)
                      bij PnP.Framework.Provisioning.ObjectHandlers.ObjectSiteSettings.ProvisionObjects(Web web, Provis
                   ioningTemplate template, TokenParser parser, ProvisioningTemplateApplyingInformation applyingInforma
                   tion)
                      bij PnP.Framework.Provisioning.ObjectHandlers.SiteToTemplateConversion.ApplyRemoteTemplate(Web we
                   b, ProvisioningTemplate template, ProvisioningTemplateApplyingInformation provisioningInfo, Boolean
                   calledFromHierarchy, TokenParser tokenParser)
                      bij PnP.PowerShell.Commands.Provisioning.Site.InvokeSiteTemplate.ExecuteCmdlet()
                      bij PnP.PowerShell.Commands.PnPSharePointCmdlet.ProcessRecord()

Linked issue: https://github.com/pnp/pnpframework/issues/193

[jackpoz]

@klaaslauwers as a workaround you could remove the pnp:SiteSettings section from the template

[klaaslauwers]

Hi @pieronegri,

I don’t want to exclude handlers; the site security is one of the things that is really needed 😃. I’m forced to schedule the script in a cronjob on a Unix server; awaiting the fix in Azure RunBooks.