Get-PnPPlannerPlan Graph Permissions seems to be wrong in the docs (https://pnp.github.io/powershell/cmdlets/Get-PnPPlannerPlan.html)

[kasperbolarsen]

Reporting an Issue or Missing Feature

Issue

Expected behavior

In the https://pnp.github.io/powershell/cmdlets/Get-PnPPlannerPlan.html the required Graph permissions are:
Required Permissions
Microsoft Graph API: Group.ReadWrite.All
Microsoft Graph API: Group.Read.All

Actual behavior

However, when I run
$allPlannerPlansInGroup = Get-PnPPlannerPlan -Group $groupId -Connection $conn -erroraction stop
in an Http triggered Azure Function (usingManaged Identity)
I get a Graph Exception

Steps to reproduce behavior

Adding Tasks.ReadWrite.All permission to my managed Identity and it works

remove the Tasks.ReadWrite.All permission and wait awhile and the exception pops up again.

What is the version of the Cmdlet module you are running?

2.4.0

Which operating system/environment are you running PnP PowerShell on?

• Windows
• Linux
• MacOS
• Azure Cloud Shell
• Azure Functions
• Other : please specify

I am not sure how to verify if this is a fluke and only is an issue when using Managed Identity in an Azure Function?

[jackpoz]

Planner used to support only delegated permissions, with application permissions being added in October 2022 https://devblogs.microsoft.com/microsoft365dev/announcing-updates-to-the-planner-api-in-microsoft-graph/ .

These are the new permissions (from https://learn.microsoft.com/en-us/graph/api/plannerplan-get?view=graph-rest-1.0&tabs=http#permissions )

Permission type	Least privileged permissions	Higher privileged permissions
Delegated	Tasks.Read	Tasks.ReadWrite, Group.Read.All, Group.ReadWrite.All
Application	Tasks.Read.All	Tasks.ReadWrite.All

Managed identity counts as Application, so that's why it's throwing that error.

A bit unsure if

powershell/src/Commands/Planner/GetPlannerPlan.cs

Line 10 in b9916f4

[RequiredMinimalApiPermissions("Group.Read.All")]

should be changed to "Tasks.Read" or "Tasks.Read.All" , as the permissions are different depending on Delegated and Application.

[kasperbolarsen]

I would say both, or replacing the current with a link to https://learn.microsoft.com/en-us/graph/api/plannerplan-get?view=graph-rest-1.0&tabs=http#permissions as the current info is wrong and might cause problems