►
Description
This PnP community demo is taken from the bi-weekly SharePoint Developer Community - General Development Special Interest Group (SIG) call recorded on March 5, 2020.
in this 18-minute demo, Paolo Pialorsi starts off by showing viewers how to create an Azure Function (App) based on PowerShell commands, how to connect to a specific tenant, and use certificates rather than login credentials of a service account for authentication. Result: Run PnP PowerShell-based script/commands in the cloud within an Azure Function to connect and manage Groups, Teams, SharePoint sites, and much more.
Demo Presenter: Paolo Pialorsi (PiaSys) – @paolopia
Supporting materials:
• Upload the PnP PowerShell module for your Azure Function | https://docs.microsoft.com/en-us/sharepoint/dev/declarative-customization/site-design-pnp-provisioning#upload-the-pnp-powershell-module-for-your-azure-function
All SharePoint PnP Developer Community demos: https://www.youtube.com/playlist?list=PLR9nK3mnD-OWSbg0o9a7mx_E7s2u7h_o2
Learn more about the SharePoint developer community at: http://aka.ms/sppnp.
A
So,
first
of
all,
in
order
to
create
our
solution,
I
need
to
create
a
function
app
in
asia
and
just
to
give
you
an
idea
of
what
are
the
basic
settings,
you
simply
need
to
add
a
new
function.
Appa
you
will
have
to
select,
of
course,
a
target
subscription
and
the
resource
group
in
which
you
will
create
the
resource
you
have
to
provide.
B
A
A
I
will
target
dotnet
core,
for
example,
and
version
3.1,
and
my
scenario
I
usually
target
West
Europe,
because
it
is
convenient
for
me,
but
once
you
do
that
you
will
have
a
major
function,
app
created
for
you,
which,
as
I
said
I
already
did
a
few
minutes
ago.
This
function,
Appa,
is
completely
empty,
I
just
created
it
and
now
in
order
to
use
it
in
order
to
host
PMP
PowerShell,
we
need
to
do
some
configuration
changes.
I
would
like
to
say.
A
Unfortunately,
we
need
to
do
some
configuration
changes,
because
right
now
we
still
have
a
PNP
powershell
built
on
top
of
dotnet
framework,
and
we
do
not
support
yet
dotnet
core
or
the
net
standard.
As
such
I
need
to
configure
in
the
platform
features
or
from
here
from
function
up
settings.
I
need
to
configure
my
function
up
to
run
with
runtime
version,
2
version
1,
so
that
I
will
be
able
to
use
dotnet
framework
and
PMP
classic
app
in
P
PowerShell.
It
will
take
a
while
to
update
this
setting.
A
So
in
the
meantime,
what
I
can
do
to
prepare
my
environment
is
to
go
to
PowerShell,
for
example,
I
use
a
PowerShell
ize,
even
if
I
I
can
eventually
use
Visual
Studio
code
or
whatever
else,
but
I
still
like
this
one.
So
I'm
keep
on
using
this
one
and
I
can
use
the
common
led,
called
save
module
and
I
will
save
the
PMP
PowerShell
library
locally
on
my
machine
in
a
folder
which
will
be
this
one
and
right
now
I'm
targeting
this
specific
version
of
PMP
PowerShell.
A
There
is
a
reason
why
this
is
the
January
2020
January,
2020
and
I'm,
not
using
the
latest
one,
because
in
that
one
right
now
we
have
a
small
issue.
When
you
run
in
people
were
shell
in
initial
function,
we
are
working
on
it
and
hopefully
we
will
fix
it
by
the
next
monthly
release,
which
will
be
the
9th
of
March.
But
right
now,
I
suggest
you
to
use
this
version
of
the
library
by
executing
this
command.
A
You
will
see
that
PowerShell
with
download
all
of
the
assemblies
or
all
the
files
of
PMP
PowerShell
in
the
local
folder
that
you
provide,
which
I
already
did
again
just
to
save
some
of
our
time,
and
here
I
have
in
this
folder
all
of
the
assemblies
which
made
up
the
PMP
PowerShell
library,
so
that,
while
we
download
the
files-
and
we
set
the
runtime
version
to
1
in
our
issue
function,
we
can
then
create
a
initial
function
in
our
function
app.
So
my
application
is
now
configured.
Let
me
add
a
new
function.
A
The
new
issue
function,
I,
will
create.
My
own
custom
function
will
leverage
the
experimental
language
support
in
order
to
be
able
to
use
PowerShell
and
I
will
select,
for
example,
in
HTTP
trigger
the
function
using
PowerShell
I
will
provide
a
name
for
my
function,
which
can
be,
for
example,
let's
say
play
with
the
PMP
function
and
I
will
create
it.
Once
I
have
created
my
new
function,
I
can
upload
all
of
the
assemblies
that
I
downloaded
with
the
saved
module
comment.
A
Later
into
the
setup
of
my
target
function,
app
in
order
to
do
that,
I
go
to
my
function,
app
platform
features
and
I
can
go
to
advanced
tools.
Khuddam
using
Kudo
I
can
have
a
a
low
level
access
to
the
file
system
of
my
function.
App
so
I
can
go
to
debug
console
PowerShell,
for
example,
and
here
I
can
search
for
my
issue
function
so
under
side
www
root.
We
will
see
that
we
have
a
folder
which
is
called
exactly
with
the
name
of
our
function.
A
In
there
we
can
create
a
new
subfolder
called
modules
and
inside
this
folder
we
will
create
another
subfolder,
which
I
will
call
exactly
with
the
name
of
the
PMP
powershell
package,
so
sharepoint
TMP
powershell
online.
This
is
the
name,
and
there
is
a
link
to
a
document
in
Doc's
dot,
Maxo
comma,
where
we
explain,
for
example,
how
to
use
this
technique
to
extend
a
site
design,
creating
an
issue
function
which
will
be
based
on
PMP
powershell
and
there
you
will
find
detailed
instructions
step
by
step
in
order
to
do
exactly
what
I'm
doing
right
now.
A
So
once
I
have
created
this
folder
I
can
go
into
the
folder
and
I
can
copy
the
whole
content
of
the
folder,
and
I
download
it
before
using
save
model.
It
will
take
a
while,
but
it
shouldn't
be
dead
much.
So,
in
a
matter
of
few
seconds,
we
will
have
all
of
the
assemblies
copied
into
this
folder
and
we
will
be
then
ready
to
start
using
PMP
PowerShell
in
our
issue
function.
A
If
your
function,
because
every
now
and
then
you
can
see
a
file
locked
by
the
upload
process,
so
better
to
wait
for
the
upload
to
be
fully
completed
and
then
move
back
to
the
user
function,
which
is
what
I'm
going
to
do
right
now,
because
the
upload
is
now
completed
so
I
can
go
back
to
my
function.
Up
I
can
get
my
issue
function,
which
is
a
PowerShell
based
and
I
can
start
writing
my
function.
A
Of
course,
I
will
use
the
connect,
TMP,
ops,
PMP
online
comment,
letter
to
connect
to
my
target
environment,
but
I
want
to
get
the
target
URL
of
the
site
as
an
input
argument
for
my
HTTP
based
function
and,
at
the
same
time,
I
want
to
have
access
to
the
target
sharepoint
online
site
using
a
set
of
credentials
which
I
will
store
as
settings
inside.
My
issue
function
configuration
so
first
of
all,
let's
start
having
a
look
at
the
source
code
of
the
function
that
I
can
use.
So
this
one.
A
Let
me
copy
it
and
explain
you.
What
is
happening
in
this
is
your
function
will
be
the
actual
function
that
I'm
going
to
use.
So
I
get
a
request,
an
HTTP
request
and
I
simply
get
the
raw
content
and
I
parse
it
as
a
JSON
message.
I
assume
that
in
the
JSON
message,
I
will
have
a
property
called
target
URL,
which
will
represent
the
URL
of
the
target
site.
I
also
seem
to
have
in
the
configuration
settings
of
my
issue
function
right
now.
A
The
username
and
the
password
of
a
service
account
that
I
want
to
use
pretty
soon.
We
will
see
that
we
can
also
use
an
application,
only
configuration
in
order
to
get
an
access
token
using
an
upon
Lea
configuration
and
we
can
skip
having
a
username
and
a
password
store
in
the
configuration
of
the
issue
function,
but
step
by
step.
We
will
get
there
so
right
now.
I
still
have
a
username
and
a
password.
What
I
can
do?
A
I
can
read
the
password
from
the
configuration
settings
and
you
can
eventually
store
that
setting
in
a
key
vault
to
properly
protect
the
password
information.
Then
I
create
a
new
set
of
credentials
based
on
the
service
account
username
and
the
password
that
I
got
from
the
settings
and
then
I
can
use
the
connect
PMP
online,
providing
the
target
URL
of
the
site
and
the
credentials
that
I
just
created
by
doing
that,
I
can
then
access
the
target
site
using
all
of
the
PMP
commandlets
that
we
have
and
I
can
play
with
the
target
site.
A
A
This
will
be
the
test.
Json
message
for
my
is
your
function.
Of
course,
I
still
need
to
configure
in
the
configuration
settings
of
my
function,
app
the
service
account
username
and
password.
So
let
me
save
the
function.
Let
me
show
you
where
you
can
configure
those
information,
so
here
under
platform
features
you
have
configuration,
and
in
this
section
you
can
configure
the
service
account
username
and
password,
which
is
something
that
I
already
did
in
my
scenario,
just
to
avoid
typing
my
password
right
now,
so
here
I
already
have
a
function
up
exactly
like
this.
A
The
one
with
just
so
and
here
I
have
my
function.
I
already
have
in
the
settings
my
username
and
password
for
the
service
account
and
if
the
powershell
will
show
up
here
it
is,
I
can
simply
run
this
function
to
show
you
the
final
outcome,
and
you
can
see
here
we
have
the
URL
of
the
target
size.
So,
let's
try.
A
Let's
run
it,
you
will
see
all
the
assemblies
will
be
loaded
into
the
process
and
then
we
will
have
access
to
the
target
set
collection
and
we
will
be
able
to
just
read
the
title
for
the
sake
of
doing
something.
But
of
course
you
can
do
whatever
you
like.
Using
PMP
were
powershell
and
targeting
the
target
environment.
A
Hopefully
the
network
will
be
with
us
and
the
output
will
be
available
on
my
screen
soon.
Okay-
and
here
it
is,
you
are
connected
to
the
side
URL
x,
y&z,
and
here
is
the
title
of
the
Turkish
side.
So
now
this
is
an
opportunity
news,
but
at
the
same
time,
as
I
said,
you
need
to
store
the
user
name
and
the
password
of
a
service
account
into
the
configuration
setting,
which
is
not
always
a
good
approach.
A
So
why
not
making
one
more
step
and
using
an
application
only
access
token
with
an
application
register
in
a
directory
directory,
which
is
what
I'm
going
to
do
so,
let
me
switch
back
to
the
tenant
where
I
have
my
target
site,
so
should
be
here.
Okay,
let
me
search
for
it.
Okay,
here
it
is,
and
if
I
go
to
portal
dot-com
and
I
into
the
settings
of
Asia
active
directory
under
up
registrations,
I
can
register
a
new
application.
I
can
call
it
whatever
you
like
so
OPM
Pecola,
20,
2003,
0,
5
demo,
for
example.
A
It
will
be
a
single
tenant
application.
In
my
scenario,
I,
don't
think
we
need
a
multi
tenant,
one
in
this
case
and
I
will
have
to
keep
track
of
the
client
ID
of
my
application
and
I
will
have
to
configure
in
the
application
permissions
the
application
permission
that
I
want
in
order
to
access
the
target
resource.
So
if
I
click
on
add
permissions,
I
can
select
to
use
a
sharepoint
online.
A
By
doing
that,
and
by
refreshing
this
page,
I
will
be
able
to
grant
a
tenant
level
with
an
admin
account
which
is
the
one
I'm,
using
the
permission
to
the
app
so
now,
I'm
ready
to
use
this
application
register
in
a
direct
directory,
but
I
also
need
because
I'm
targeting
sharepoint
online
to
configure
an
x.509
certificate
which
I
will
use
to
authenticate
against
a
key
directory
to
get
an
app
only
access
token.
How
can
I
do
that
back
in
PowerShell
I
can
execute
another
TMP
common
letter,
which
is
the
new
PNP
age
of
certificate.
A
You
will
have
to
provide
a
common
name
for
a
certificate
that
will
be
created
for
you.
You
will
have
to
provide
a
number
of
years
for
the
lifetime
of
your
certificate,
the
password
which
can
be
whatever
you
like.
You
will
store
the
output
pfx
file,
so
the
one,
including
the
private
key
and
the
output
dot
serve
file,
so
the
one
just
including
the
public
part
of
the
certificate
in
your
file
system.
A
This
is
just
a
fake
password
that
I
am
going
to
use
and
this
certificate
will
be
used
to
identify
and
to
authenticate
the
application
against
Asia
Active
Directory.
So
let
me
run
this
script
now.
I
have
in
my
local
folder
a
certificate,
so
what
I
can
do?
I
can
go
back
to
Asia,
active
directory
and
in
certification
secrets.
I
can
upload
a
new
certificate.
I
can
browse
on
my
file
system
to
get
the
certificate
that
I
just
created,
and
this
certificate
will
be
used
to
identify
the
identity
of
my
up
in
a
shrug
director.
A
So
back
on
the
asia
function
side
of
the
story.
So
right
here,
if
I
go
back
to
my
asia
function,
I
can
configure
under
ssl
so
the
ssl
settings
on
my
function
in
the
private
key
certificate
section
I
can
upload
the
p
FX
file
that
I
just
created
I
can
provide
the
password
that
I
configured,
which
is,
of
course,
a
trivial
one.
Right
now,
I
can
upload
my
p
FX
file
into
the
function
app
by
doing
that,
I
will
be
able
to
access
the
certificate
and
the
private
key
of
the
certificate
inside
my
issue
function.
A
How
can
we
do
that?
Well,
first
of
all,
I
need
to
configure
a
bunch
of
settings
in
the
configuration
of
my
app,
so
I
will
have
to
configure
the
application
setting
for
the
thumbprint
of
my
certificate,
so
I
will
create
a
new
item
called
thumbprint
which
will
have
the
value.
Has
the
value
of
the
thumbprint
of
this
OP?
Sorry
of
the
certificate
that
I
just
created
I
will
configure
the
client
ID
of
my
application,
so
client,
ID
and
I
will
copy
the
ID
from
the
overview
tab
of
my
application
right
here.
A
A
Alpha
that
I
want
to
allow
the
function
app
to
load
the
certificate,
so
I
will
configure
the
website
underscore
Lord
underscore
certificate
setting
to
asterisk,
which
means
you
can
load
every
any
kind
of
certificate
or
I
can
even
specify
the
tampering
of
the
specific
certificate
that
I
want
to
load.
By
doing
that,
in
my
eyes,
your
function-
and
we
are
almost
done
I-
will
be
able,
of
course,
I
need
to
save
my
settings.
A
I
will
be
able
to
switch
to
a
different
syntax,
which
is
the
one
I'm
going
to
show
you
now
so
I
will
be
able
to
read
from
the
environment
so
from
the
configuration
the
tenant,
I
name,
the
client
ID
and
the
thumbprint
and
I
will
be
able
to
use
the
connect.
The
impugn
line
providing
those
settings
instead
of
a
set
of
credentials
based
on
a
service
account.
So
if
I
do
that
and
if
I
copy
this
into
the
definition
of
my
issue
function.
A
This
is
my
new
function
in
which
I
will
simply
get
the
tenant,
the
client
ID
and
the
thumbprint,
and
we
connect
an
app
only
access,
token
and
I
will
be
still
able
to
access
the
target
environment
and
to
do
whatever
I
want
to
do
using
PMP
PowerShell
without
the
need
to
store
any
kind
of
password
in
the
configuration
of
my
function,
app
so
quite
a
step
by
step
long
journey,
but
you
can
get
to
the
point
of
being
able
to
consume
a
target.
Sharepoint
online
environment
using
PMP
powershell
within
an
insurer
function.