Access is denied (0x80070005 (E_ACCESSDENIED)) while provisioning template with PnP PowerShell

Introduction

By utilizing the PnP PowerShell module, users can harness the power of scripting to automate tasks, reduce manual errors, and manage SharePoint resources effectively.

This approach not only saves time but also enhances consistency across different environments. Additionally, leveraging this powerful tool allows for customization options that can align with specific project requirements.

If you’re interested in knowing more about PnP PowerShell, have a look at the official site here.

To provision a site template with PnP PowerShell, you will have simply to invoke the correct command, for example the following one:

Invoke-PnPSiteTemplate -Path "Provisioning-template.xml"

While this approach is a must go for, sometimes errors pop up, in fact today I’ve faced the following error:

Invoke-PnPSiteTemplate: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

So, let’s cover how I faced this issue.

Debugging

To understand what is happening, since the error is not friendly at all, I’ve enabled the trace logging. You can do this with the following command:

Set-PnPTraceLog -On -LogFile log.txt -Level Debug

In this example, this command will save all the debugging logs to a file named log.txt.

This allowed me to scan the logs and finding out the following rows (cleaned up a little bit for better reading):

[Debug] Updating field {GUID} in site

[PnP.Framework] [0] [Error] ExecuteQuery threw following exception: Microsoft.SharePoint.Client.ServerUnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

Turned out

In my case, it turned out that the issue was generated by the field _ExtendedDescription present in my template file.

After banging my head on a wall for a while I understood what was happening.

I discovered that the issue was generated from a setting of the SharePoint site, setting the DenyAddAndCustomizePages to false resolved the issue!

Set-PnPTenantSite -Url "<your site URL>" -DenyAddAndCustomizePages:$false

Conclusions

It seems that the setting DenyAddAndCustomizePages prevent updating some field so, if the next time you’re provisioning a site template with PnP PowerShell keep this in mind! I hope that this article helps you avoiding banging your head like I did! And if it’s not, let’s connect on socials and discuss your issue!

Hope this helps!