[BUG] Can't empty recycle bin of personal sharepoint

[FlorianTschimbenCoolorange]

Hello, I want to move the items in my recycle bin to my secondary-stage recycle bin with a script:
For the Connection to the personal sharepoint I used my personal Account and the following Cmdlet:
Connect-PnPOnline -Url "https://<tenant>-my.sharepoint.com/personal/<site>" -ClientId $clientId -Tenant $tenantId -DeviceLogin.
This works fine.
Then the command to execute would just be Move-PnPRecycleBinItem -Force (but it throws the Error Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))).
The Entra ID has the Sharepoint API permissions: Sites.FullControl.All, Sites.Manage.All, Sites.Read.All, Sites.ReadWrite.All, Sites.Selected

I can access the normal files in the personal Sharepoint just fine, but when I try to do something in the recycle bin I always get the same Error.

What is the version of the Cmdlet module you are running?

3.1.0

Which operating system/environment are you running PnP PowerShell on?

• Windows
• Linux
• MacOS
• Azure Cloud Shell
• Azure Functions
• Other : please specify

[reshmee011]

I could not reproduce the issue with same version on PnP PowerShell, i.e. 3.1.0.

The cmdlet Move-PnPRecycleBinItem moved all the deleted items /files into the secondary stage recycle bin. Can you perform any cmdlets against your OneDrive/personal SharePoint like Get-PnPList or any read operation.?

[FlorianTschimbenCoolorange]

I can read any files, that are not in my recycle bin just fine, but if I try to access the recycle bin (first and second stage), I always get the Error: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

[reshmee011]

Is it your own personal onedrive site or another user's one.? I tested against my own OneDrive and worked. Are you able to grant yourself site collection admnistrator on the personal OneDrive if it is not yours and try again ?

[FlorianTschimbenCoolorange]

It is my personal OneDrive in my tenant. I have already given myself the site collection administrator, but that changed nothing.

[reshmee011]

Is it possible to try against a different OneDrive site or even SharePoint site to which you have site collection admin rights? The cmdlet would behave the same for SharePoint and OneDrive site as long as you have site admin rights to confirm where the issue lies, the Entra ID registration set up or lack of site admin access to the sites?

[FlorianTschimbenCoolorange]

The EntraID has the following permissions: Sites.FullControl.All, Sites.Manage.All, Sites.Read.All, Sites.ReadWrite.All, Sites.Selected

I have also tried to use it on another personal OneDrive (not mine), where i have the site admin rights (I double checked it), but it didn't work either. I even gave someone else the entraID to check if he can perofrm the Move-PnPRecycleBinItem on his personal OneDrive, but he got the same Error...

[reshmee011]

I can't replicate the issue on a different tenant ,
Entra Id set up

Output from cmdlet:

Try on a SharePoint site which is not a OneDrive please to know if it's an issue with OneDrive set up.

[FlorianTschimbenCoolorange]

Is it possible to downgrade the Entra ID permissions? I’d prefer it not have access to every file in my tenant.

I specifically need it to access my OneDrive site, so testing it on a SharePoint site wouldn’t be useful— even if it works there, it doesn’t help with my actual use case.

[reshmee011]

Yes you can by following the instructions from the blog post https://www.leonarmston.com/2022/02/use-sites-selected-permission-with-fullcontrol-rather-than-write-or-read/.

[FlorianTschimbenCoolorange]

I tried using Sites.Selected, but it resolves in the same issue:

I can Read and writes in my OneDrive normally, but accessing my recycle bin throws the Error Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

[reshmee011]

Is it possible to try it against a SharePoint site just to see where the issue might be, Entra ID or OneDrive setting?

[FlorianTschimbenCoolorange]

I tried doing it with the same rights as I did before on a new Sharepoint Site, I got the same error: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

I tried using your Entra Id Setup, and that worked, on both OneDrive and Sharepoint. But with the Sites.Selected, it wasn't successful. Can you tell me what the minimum requirements for the Move-PnPRecycleBinItem -Force command are?

[reshmee011]

What your "Entra Id Setup" means? I think there may be an issue with "Sites.Selected", e.g. #5169, #5139

Site collection administrator rights are enough to use the Move-PnPRecycleBinItem.