PnP PowerShell Script Generator

PnP PowerShell

PnP.PowerShell is the community module that does in one cmdlet what CSOM takes twenty lines to do. It is cross-platform and targets PowerShell 7; it replaced the older, Windows-only SharePointPnPPowerShellOnline, which is retired. If you are following a guide that opens with Connect-PnPOnline -UseWebLogin, it predates the current module and the advice that follows it is probably stale too.

You must register your own Entra application

This is the step that stops most people. Recent versions no longer ship a multi-tenant application to authenticate through, so there is no client ID built into the module any more. Before the first interactive connection you register one in your own tenant — Register-PnPEntraIDAppForInteractiveLogindoes it for you — and then pass its client ID on every connect. A first run that fails with an unauthorised or missing-client-ID error is almost always this, not a permissions problem.

Interactive for people, certificates for automation

-Interactiveis right at a keyboard: it prompts, honours MFA, and acts as you. Anything unattended — a scheduled job, a pipeline — should use an app registration with a certificate rather than a stored secret, because app-only access is exactly the credential you do not want sitting in a variable somewhere. App-only connections also run without a user context, so anything that depends on the current user behaves differently from your interactive testing.

Batch bulk operations

A loop calling Set-PnPListItem once per row issues one request per row and will take hours on a list of any size. New-PnPBatch with -Batch on each call, committed by Invoke-PnPBatch, collapses those into a handful of requests. For scripts touching thousands of items this is the difference between minutes and an afternoon, and it also reduces the throttling you provoke.

Throttling is normal, not an error

SharePoint Online throttles aggressively and the module already retries with backoff when it sees a 429. The correct response to throttling is to batch and to slow down, not to parallelise harder — running many connections at once reliably makes it worse, and sustained abuse can escalate from throttling to a temporary block.

Large lists still need paging

Get-PnPListItem against a list over the 5,000 item threshold needs -PageSize so it retrieves in chunks; without it you hit the same list view threshold the browser does. Combine it with -Fields to fetch only the columns you need, which matters more than it sounds on wide lists.

Connections are explicit

Cmdlets use the most recent connection by default, which is fine until a script touches two sites and quietly writes to the wrong one. Capture connections with -ReturnConnection and pass them with -Connection whenever more than one site is in play. The scripts generated above cover site, list, content, permission and bulk operations; treat them as a starting point to read rather than a black box to run, and test destructive ones against a throwaway site first.