SharePoint Powershell MFA

[robyholmes]

Hi All,

 

I'm trying to use a script to change the timezone on all my existing SharePoint sites (Have found the default to be wrong). I've found a number of scripts on this site:

https://www.sharepointdiary.com/2017/06/sharepoint-online-change-time-zone-using-powershell.html

 

I'm trying to use the bottom tenant wide script. However I'm getting stuck all the time with an error when setting the timezone: The remote server returned an error: (401) Unauthorized.

It does this on any site I'm not a member of. My account however is a SharePoint Online admin which should then allow access. However I also have MFA so I've changed the script a little so I can connect using MFA.

 

#Load SharePoint CSOM Assemblies
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.dll"
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.Runtime.dll"

#function to change Timezone regional settings of a SharePoint Online site
Function Set-SPOnlineTimeZone([string]$SiteURL,[string]$TimezoneName,[PSCredential]$Cred)
{
    Try
    {
       #Setup Credentials to connect
       $Credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($Cred.Username, $Cred.Password)
  
       #Set up the context
       $Ctx = New-Object Microsoft.SharePoint.Client.ClientContext($SiteURL)
       $Ctx.Credentials = $credentials
  
       #Get the Root web from given URL
       $Web = $Ctx.web
       $Ctx.Load($Web)

       #Get the Time zone to update
       $Timezones = $Web.RegionalSettings.TimeZones
       $Ctx.Load($Timezones)
       $Ctx.ExecuteQuery()
       $NewTimezone = $Timezones | Where {$_.Description -eq $TimezoneName}
 
       #Update the timezone of the site
       $Web.RegionalSettings.TimeZone = $NewTimezone
       $Web.Update()
       $Ctx.ExecuteQuery()

       Write-host -f Green "Timezone has been updated for "$Web.Url

       #Get all subsites of the web
       $Ctx.Load($Web.Webs)
       $Ctx.executeQuery()

       #Iterate through each subsites and call the function recursively
       Foreach ($Subweb in $Web.Webs)
       {
           #Call the function to set Timezone for the web
           Set-SPOnlineTimeZone -SiteURL $Subweb.URL -TimezoneName $TimezoneName -Cred $AdminCredentials
       }
  }
   Catch [system.Exception]
   {
       Write-Host -f Red $_.Exception.Message
   }
}

#Config parameters for SharePoint Online Admin Center and Timezone description
$AdminSiteURL = "ADMIN URL"
$TimezoneName ="(UTC) Dublin, Edinburgh, Lisbon, London"

#Get credentials to connect to SharePoint Online Admin Center
$AdminCredentials = Get-Credential

#Connect to SharePoint Online Tenant Admin
Connect-SPOService -URL $AdminSiteURL

#Get all Site Collections
$SitesCollection = Get-SPOSite -Limit ALL

#Iterate through each site collection
ForEach($Site in $SitesCollection)
{
   Write-host -f Yellow "Setting Timezone for Site Collection:"$Site.URL

   #Call the function to set Timezone for the site
   Set-SPOnlineTimeZone -SiteURL $Site.URL -TimezoneName $TimezoneName -cred $AdminCredentials
}


#Read more: https://www.sharepointdiary.com/2017/06/sharepoint-online-change-time-zone-using-powershell.html#ixzz6ME4NC0Ne

 

I think the issue is the Set-SPOnlineTimeZone command is using the $AdminCredentials information which doesn't include MFA. However I can't found a way of telling it to use it. I've spent pretty much all day on this now and tried all sorts of different commands and scripts without luck.

 

Has anyone managed to run commands on SharePoint sites with MFA?

[robyholmes]

I've managed to find a workaround to do what I need. So I thought I'd update this post.

 

Firstly I had to use a App Password so MFA wasn't required. I could then use the original code.

 

I then found I was still getting the 401 error on certain sites. It seems even if your a SharePoint Admin you can't change these settings without having access to the site. So I added myself as a 'Additional Admin' to the sites to get round this. I did this as part of the script which I've updated below.

 

#Load SharePoint CSOM Assemblies
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.dll"
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.Runtime.dll"

#function to change Timezone regional settings of a SharePoint Online site
Function Set-SPOnlineTimeZone([string]$SiteURL,[string]$TimezoneName,[PSCredential]$Cred)
{
    Try
    {
       #Setup Credentials to connect
       $Credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($Cred.Username, $Cred.Password)
  
       #Set up the context
       $Ctx = New-Object Microsoft.SharePoint.Client.ClientContext($SiteURL)
       $Ctx.Credentials = $credentials
  
       #Get the Root web from given URL
       $Web = $Ctx.web
       $Ctx.Load($Web)

       #Get the Time zone to update
       $Timezones = $Web.RegionalSettings.TimeZones
       $Ctx.Load($Timezones)
       $Ctx.ExecuteQuery()
       $NewTimezone = $Timezones | Where {$_.Description -eq $TimezoneName}
 
       #Update the timezone of the site
       $Web.RegionalSettings.TimeZone = $NewTimezone
       $Web.Update()
       $Ctx.ExecuteQuery()

       Write-host -f Green "Timezone has been updated for "$Web.Url

       #Get all subsites of the web
       $Ctx.Load($Web.Webs)
       $Ctx.executeQuery()

       #Iterate through each subsites and call the function recursively
       Foreach ($Subweb in $Web.Webs)
       {
           #Call the function to set Timezone for the web
           Set-SPOnlineTimeZone -SiteURL $Subweb.URL -TimezoneName $TimezoneName -Cred $AdminCredentials
       }
  }
   Catch [system.Exception]
   {
       Write-Host -f Red $_.Exception.Message
   }
}

#Config parameters for SharePoint Online Admin Center and Timezone description
$AdminSiteURL = "https://SHAREPOINT SITE URL.sharepoint.com/"
$TimezoneName ="(UTC) Dublin, Edinburgh, Lisbon, London"

#Get credentials to connect to SharePoint Online Admin Center
$AdminCredentials = Get-Credential

#Connect to SharePoint Online Tenant Admin
Connect-SPOService -URL $AdminSiteURL -Credential $AdminCredentials
#Connect-SPOService -URL $AdminSiteURL

#Get all Site Collections
$SitesCollection = Get-SPOSite -Limit ALL

#Iterate through each site collection
ForEach($Site in $SitesCollection)
{
   Write-host -f Yellow "Setting Timezone for Site Collection:"$Site.URL

   #Add as additional admin
   Set-SPOUser -Site $Site.URL -LoginName SITE ADMIN ACCOUNT YOUR USING -IsSiteCollectionAdmin $True

   #Call the function to set Timezone for the site
   Set-SPOnlineTimeZone -SiteURL $Site.URL -TimezoneName $TimezoneName -cred $AdminCredentials
}


#Read more: https://www.sharepointdiary.com/2017/06/sharepoint-online-change-time-zone-using-powershell.html#ixzz6ME4NC0Ne

 

It's not ideal but it works.

[Maxcobos]

Came across this issue also, without being an additional admin you can't change much in PS, use the below to scan through every site and add yourself (or the designated user account) as an additional admin to every site.

 

#Variables for processing

$AdminURL = "https://domain-admin.sharepoint.com"

$AdminName="[email protected]"

 

#Connect to SharePoint Online

Connect-SPOService -url $AdminURL -credential (Get-Credential)

 

#Get All Site Collections

$Sites = Get-SPOSite -Limit ALL

 

#Loop through each site and add site collection admin

Foreach ($Site in $Sites)

{

Write-host "Adding Site Collection Admin for:"$Site.URL

Set-SPOUser -site $Site.Url -LoginName $AdminName -IsSiteCollectionAdmin $True

}