[BUG] Unable to use metered APIs

[dgaiero]

Notice

Many bugs reported are actually related to the PnP Framework which is used behind the scenes. Consider carefully where to report an issue:

1. Are you using Invoke-PnPSiteTemplate or Get-PnPSiteTemplate? The issue is most likely related to the Provisioning Engine. The Provisioning engine is not located in the PowerShell repo. Please report the issue here: https://github.com/pnp/pnpframework/issues.
2. Is the issue related to the cmdlet itself, its parameters, the syntax, or do you suspect it is the code of the cmdlet that is causing the issue? Then please continue reporting the issue in this repo.
3. If you think that the functionality might be related to the underlying libraries that the cmdlet is calling (We realize that might be difficult to determine), please first double check the code of the cmdlet, which can be found here: https://github.com/pnp/powershell/tree/master/src/Commands. If related to the cmdlet, continue reporting the issue here, otherwise report the issue at https://github.com/pnp/pnpframework/issues

Reporting an Issue or Missing Feature

I cannot use the metered APIs. I believe this is due to the fact that in the Azure app registration uses "Mobile and Desktop Application" instead of "Web". I tried switching to web, but got this error:

Connect-PnPOnline: A configuration issue is preventing authentication - check the error message from the server for details. You can modify the configuration in the application registration portal. See https://aka.ms/msal-net-invalid-client for details. Original exception: AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'. Trace ID: 17b094b5-7abc-5137-c1a4-a35e635d3c28 Correlation ID: 17b094b5-7abc-5137-c1a4-a35e635d3c28 Timestamp: 2026-02-18 21:57:12Z

from: https://learn.microsoft.com/en-us/graph/metered-api-overview

I was following this issue for some background information: #4792.

Expected behavior

The script should return a success that the label should be changed.

Actual behavior

Add-PnPFileSensitivityLabel: Call to Microsoft Graph URL https://graph.microsoft.com/v1.0/drives/REDACTED/items/REDACTED/assignSensitivityLabel failed with status code PaymentRequired: Payment Required. Ensure that your application is able to call this premium API.For details see https://aka.ms/graph-metered-overview

Steps to reproduce behavior

Followed the same steps as in #4792

What is the version of the Cmdlet module you are running?

(you can retrieve this by executing Get-Module -Name "PnP.PowerShell" -ListAvailable)

ModuleType Version    PreRelease Name                                PSEdition ExportedCommands
---------- -------    ---------- ----                                --------- ----------------
Manifest   3.1.309    nightly    PnP.PowerShell                      Desk      {Add-PnPAdaptiveScopeProperty, Add-PnPAzureADGroupMember, Add-PnPAzu…
Manifest   3.1.300    nightly    PnP.PowerShell                      Desk      {Add-PnPAdaptiveScopeProperty, Add-PnPAzureADGroupMember, Add-PnPAzu…
Manifest   3.1.0                 PnP.PowerShell                      Core      {Add-PnPAdaptiveScopeProperty, Add-PnPEntraIDGroupMember, Add-PnPEnt…

Which operating system/environment are you running PnP PowerShell on?

• Windows
• Linux
• MacOS
• Azure Cloud Shell
• Azure Functions
• Other : please specify

[reshmee011]

@dgaiero : Did you try to reproduce the same request through Graph Explorer to see if you get the same issue? I don't have metered APIs enabled on my dev tenant to test it out.

[dgaiero]

@dgaiero : Did you try to reproduce the same request through Graph Explorer to see if you get the same issue? I don't have metered APIs enabled on my dev tenant to test it out.

I wasnt able to figure out how to get graph explorer to use metered API calls since it didn't have an app registration with it. However, I ran a curl request using the same app registration that I used for my PnP call, and it worked - I was able to verify on sharepoint that the item has the new sensitivity label. This is the code that I used:

export token=`curl -sS \
    -d grant_type=client_credentials \
    -d client_id=$ENTRAID_CLIENT_ID \
    -d client_secret=$ENTRAID_CLIENT_SECRET \
    -d scope=https://graph.microsoft.com/.default \
    -d resource=https://graph.microsoft.com \
    https://login.microsoftonline.com/$ENTRAID_TENANT_ID/oauth2/token \
    | jq -j .access_token`

curl -sS -X POST \
    -H "Authorization: Bearer $token" \
    -H "Content-Type: application/json" \
    "https://graph.microsoft.com/v1.0/drives/$ENTRAID_DRIVE_ID/items/$ENTRAID_ITEM_ID/assignSensitivityLabel" \
    --data "{\"sensitivityLabelId\": \"$ENTRAID_SENSITIVITY_LABEL_ID\"}" \
    | jq .

curl -sS -X GET \
    -H "Authorization: Bearer $token" \
    -H "Content-Type: application/json" \
    "https://graph.microsoft.com/v1.0/drives/$ENTRAID_DRIVE_ID/items/$ENTRAID_ITEM_ID" \
    | jq .

I did try connecting using example three: https://pnp.github.io/powershell/cmdlets/Connect-PnPOnline.html#example-3. However, with the legacy connection I couldn't use the Update-ItemSensitivityLabel cmdlet