CreateSiteCollectionAsync returns a 403 error

[ajcaterino]

var teamSiteToCreate = new TeamSiteWithoutGroupOptions(new Uri(pageParameters.NewSiteUrl), $"{pageParameters.NewSiteTitle}")
{
    SiteDesignId = _dmSettings.SiteDesignId,
    Owner = $"i:0#.f|membership|{_dmSettings.SiteOwners[0]}",
    Language = PnP.Core.Admin.Model.SharePoint.Language.English,
    HubSiteId = await GetHubSiteIdAsync()
};

var siteCreationOptions = new SiteCreationOptions()
{
    UsingApplicationPermissions = true,
    WaitForAsyncProvisioning = true
};

_logger.LogInformation("Creating site {NewSite}", pageParameters.NewSiteUrl);
using var pnpContext = await _pnpContextFactory.CreateAsync(new Uri(_dmSettings.SharePointAdminUrl));

// Create new site...
using var newSiteContext = await pnpContext.GetSiteCollectionManager().CreateSiteCollectionAsync(teamSiteToCreate, siteCreationOptions);

I am using the above code to create a new site collection. This code works in my development environment but not in my production environment. In production I keep getting a 403 Unauthorized error, which I'm leaning towards a permission issue. I am using username/password login as below:

builder.Services.AddPnPCore(o =>
{
    o.PnPContext.GraphFirst = true;
    o.PnPContext.GraphCanUseBeta = true;
    o.PnPContext.GraphAlwaysUseBeta = false;
    o.HttpRequests.Timeout = 300;
});

builder.Services.AddPnPCoreAuthentication(o =>
{
    o.Credentials.Configurations.Add("usernamePassword",
        new PnPCoreAuthenticationCredentialConfigurationOptions
        {
            UsernamePassword = new PnPCoreAuthenticationUsernamePasswordOptions
            {
                Username = dmSettings.SvcAccountUser,
                Password = dmSettings.SvcAccountPassword
            }
        });

    o.Credentials.DefaultConfiguration = "usernamePassword";
});

The service user account I am using is a SharePoint Admin account. Any guidance to setting the correct permissions, or what to check for, would be greatly appreciated. Also, the user does not have MFA, but we do use Conditional Access Policies.

[jansenbe]

@ajcaterino : if you're using a user then you need to set "UsingApplicationPermissions" to false, but don't think that's causing the issue. Would recommend doing a Fiddler trace to see what goes wrong, or alternatively grab the actual underlying error information (see https://pnp.github.io/pnpcore/using-the-sdk/basics-errorhandling.html#catching-a-pnp-core-sdk-exception-and-getting-the-exception-details).

[jansenbe]

@ajcaterino : can you check if below setting is checked in your production tenant?

[ajcaterino]

My apologies, but I forgot to mentioned that I am converting a PowerShell process to .NET. The current PowerShell process uses the same service account and is currently working in the same environment.

[jansenbe]

@ajcaterino : how did you authenticate in PnP PowerShell? What cmdlet did you use to create the site collection?

[ajcaterino]

I finally got this working. What I found was that I had to remove the HubSiteId assignment from the below code. I then joined the Hub Site after the site collection was created and admins had been assigned. Once I did that I no longer received the 403 Unauthorized error.

var teamSiteToCreate = new TeamSiteWithoutGroupOptions(new Uri(pageParameters.NewSiteUrl), $"{pageParameters.NewSiteTitle}")
{
    SiteDesignId = _dmSettings.SiteDesignId,
    Owner = $"i:0#.f|membership|{_dmSettings.SiteOwners[0]}",
    Language = PnP.Core.Admin.Model.SharePoint.Language.English,
    HubSiteId = await GetHubSiteIdAsync()
};