A client recently asked me for a report of every document library on 40 intranet sites. Clicking through Site contents wasn’t an option, so step one was a PowerShell session connected to SharePoint Online. That step trips people up now, because older copy-paste commands stop at an error.
Here’s how I connect today, tested on my own Microsoft 365 tenant in PowerShell 7: PnP PowerShell for site work, the SharePoint Online Management Shell for tenant admin tasks, certificates for unattended scripts, and fixes for the usual errors.
Quick answer: For a site, install PnP PowerShell in PowerShell 7.4+, register your own Entra ID app once with Register-PnPEntraIDAppForInteractiveLogin, then run Connect-PnPOnline -Url https://contoso.sharepoint.com/sites/Marketing -ClientId <your-app-id> -Interactive. For tenant administration, install Microsoft.Online.SharePoint.PowerShell and run Connect-SPOService -Url https://contoso-admin.sharepoint.com as a SharePoint Administrator.
PnP PowerShell or SharePoint Online Management Shell?
There are two PowerShell modules for SharePoint Online, and they connect to different things. Pick based on the job, not habit. If you’re new to SharePoint itself, the SharePoint tutorials hub covers the basics first.
| PnP PowerShell | SharePoint Online Management Shell | |
|---|---|---|
| Connect cmdlet | Connect-PnPOnline | Connect-SPOService |
| Connects to | One site (any URL) | The SharePoint admin center |
| Who can use it | Anyone with access to the site | SharePoint Administrators |
| PowerShell version | 7.4.0 or later | Windows PowerShell 5.1, or 7 with -UseWindowsPowerShell |
| Typical jobs | Lists, items, libraries, files, pages, permissions | Create or delete sites, storage quotas, sharing settings, tenant reports |
Install the modules and check your PowerShell version
PnP PowerShell 3.x requires PowerShell 7.4.0 or later, so it won’t load in the blue Windows PowerShell 5.1 console. Install PowerShell 7 first if you don’t have it, then install the modules for your account. I walk through every install option in installing PnP PowerShell for SharePoint Online.
# PnP PowerShell (needs PowerShell 7.4 or later)
Install-Module PnP.PowerShell -Scope CurrentUser
Update-Module PnP.PowerShell
# SharePoint Online Management Shell
Install-Module Microsoft.Online.SharePoint.PowerShell -Scope CurrentUser
Update-Module Microsoft.Online.SharePoint.PowerShell-Scope CurrentUser skips the need for an elevated window. Here’s how I confirm the PowerShell version and the newest version of each module:
Register your own Entra ID app for PnP PowerShell
This is the step most older guides skip. Since September 9, 2024, Connect-PnPOnline needs a -ClientId for interactive, device code and credential sign-ins. The shared PnP Management Shell app that used to work without one is gone, so you register an app in your own tenant once and reuse its ID.
The quickest way is the PnP cmdlet, which creates the app with a limited set of delegated permissions and asks you to consent:
Register-PnPEntraIDAppForInteractiveLogin -ApplicationName "PnP.PowerShell" -Tenant contoso.onmicrosoft.com- Role: Application Developer can create the app, but granting admin consent usually needs a Global Administrator. If the Grant admin consent button is grayed out, ask your admin.
- Client ID: copy the Application (client) ID from the output or from Microsoft Entra admin center > App registrations. That GUID is your
-ClientId. - Manual registration: if you create the app yourself, add
http://localhost(http, not https) as a Mobile and desktop applications redirect URI.
Tired of pasting the GUID? Set the ENTRAID_APP_ID environment variable in your profile and PnP picks it up automatically.
Connect to a SharePoint site with Connect-PnPOnline
With the app in place, connecting to a site is one line. -Interactive opens the Microsoft sign-in window, so MFA and Conditional Access work the way they do in the browser:
$siteUrl = "https://contoso.sharepoint.com/sites/Marketing"
$clientId = "00000000-0000-0000-0000-000000000000" # your app's Application (client) ID
Connect-PnPOnline -Url $siteUrl -ClientId $clientId -InteractiveOn a server without a browser, or over a remote session, use -DeviceLogin instead. PnP shows a code; you open microsoft.com/devicelogin on any device, enter it and sign in. Add -PersistLogin and PnP caches the token, so the next session for the same tenant and client ID connects without a prompt.
Here’s the script I ran against my test site, using device login with a persisted token: