Minimum Permissons require to run the New-PnPUPABulkImportJob

[sivakavurinjc]

$WebUrl = "https://*******.sharepoint.com/sites/UserProfileSync"
$LibraryName ="Shared Documents"
$userLookupKey="IdName"
$propertyMap = New-Object -type 'System.Collections.Generic.Dictionary[String,String]'
$propertyMap.Add("IsAccountDisabled", "IsAccountDisabledSTR")
$propertyMap.Add("Location", "ELocation")
Connect-PnPOnline -Url $WebUrl -ClientId $ClientId -Tenant $TenantId -CertificatePath $CertificatePath -CertificatePassword $securePassword
$job = New-PnPUPABulkImportJob -Folder $LibraryName -Path $localFilePath -IdProperty $userLookupKey -UserProfilePropertyMapping $propertyMap 
$job

When I run the above script I am getting an error "Attempted to perform an unauthorized operation."

The following are the permissions that are granted for the client id

1. Sites.Selected (Application Permissions)
2. Granted the full control to site using https://*******.sharepoint.com/sites/UserProfileSync/_layouts/15/appinv.aspx
3. Also Granted the following permissions for https://*-admin.sharepoint.com/_layouts/15/appinv.aspx

      <AppPermissionRequests AllowAppOnlyPolicy="true">
  <AppPermissionRequest Scope="http://sharepoint/content/tenant" Right="FullControl" />
  <AppPermissionRequest Scope="http://sharepoint/social/tenant" Right="FullControl" />
</AppPermissionRequests>

Do we need to still grant Sites.ReadWrite.All for SharePoint for the App registration?

[rakeshranderia]

I believe the issue is that two different app-only permission models are being mixed here...

Your Connect-PnPOnline -ClientId ... -CertificatePath connection is Entra ID app-only authentication, as such the permissions granted throughappinv.aspxare from the older SharePoint ACS/add-in model, so they do not grant permissions to the Entra app you are authenticating with.

For the SharePoint bulk user-profile import API, Microsoft currently documents Entra app-only as requiring Sites.FullControl.All and User.ReadWrite.All application permissions, with admin consent.

I would not expect Sites.Selected on the staging site to be sufficient, because the operation is against the tenant User Profile service not just the library containing the JSON file.

I'd grant the documented application permissions, reconnect using the certificate, and test again.

Also I don't think adding only Sites.ReadWrite.All to solve this, per Microsoft documentation for this API, ref: [https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/bulk-user-profile-update-api-for-sharepoint-online]