PowerShell脚本报错：无法将String转为PSCredential求协助

错误原因 #

你遇到的错误Cannot bind parameter 'ClientSecretCredential'. Cannot convert the value of type "System.String" to type "System.Management.Automation.PSCredential"，根源是新版PnP.PowerShell模块（v2.x+）修改了Connect-PnPOnline的参数要求：

• 原-ClientSecret参数不再接受明文字符串，而是需要传入PSCredential对象；
• 或者使用-ClientSecretCredential参数配合ClientSecretCredential实例进行认证。

你的脚本中直接传递明文的客户端密钥字符串，导致类型不匹配。

修复步骤 #

1. 调整SharePoint认证逻辑 #

将原有的Connect-PnPOnline调用替换为以下两种方式之一：

方式一：使用PSCredential对象（推荐）

利用你已存储的$secureClientSecret（SecureString类型）创建PSCredential，再传递给-Credential参数：

# 创建PSCredential对象
$pnpCredential = New-Object System.Management.Automation.PSCredential ($clientId, $secureClientSecret)
# 连接SharePoint
Connect-PnPOnline -Url $siteUrl -Credential $pnpCredential -Tenant $tenantId.Trim() -ErrorAction Stop

方式二：使用ClientSecretCredential对象

如果需要更贴合现代认证流程，可以创建ClientSecretCredential实例：

# 导入所需命名空间
using namespace Azure.Identity
# 创建ClientSecretCredential对象
$clientSecretCredential = [ClientSecretCredential]::new($tenantId, $clientId, $secureClientSecret)
# 连接SharePoint
Connect-PnPOnline -Url $siteUrl -ClientSecretCredential $clientSecretCredential -ErrorAction Stop

2. 可选：优化Microsoft Graph认证 #

虽然你的Connect-MgGraph调用暂时能运行，但新版Microsoft Graph PowerShell也推荐使用ClientSecretCredential，可以同步优化：

# 替换原Connect-MgGraph行
$mgCredential = [ClientSecretCredential]::new($tenantId, $clientId, $secureClientSecret)
Connect-MgGraph -Credential $mgCredential -TenantId $tenantId

修改后的完整脚本 #

param (
    [string]$SavePath = "C:\Path\To\Save"
)

# 安装并导入模块的函数
function Install-AndImportModule {
    param (
        [string]$ModuleName
    )
    if (-not (Get-Module -Name $ModuleName -ListAvailable)) {
        Install-Module -Name $ModuleName -Scope AllUsers -Force -ErrorAction Stop
    }
    Import-Module -Name $ModuleName -ErrorAction Stop
}

try {
    # 需要确保的模块列表
    $modules = @(
        "Microsoft.Graph",
        "PnP.PowerShell",
        "Microsoft.Graph.Authentication",
        "Microsoft.PowerShell.SecretManagement",
        "Microsoft.PowerShell.SecretStore"
    )

    # 安装并导入所有模块
    foreach ($module in $modules) {
        Install-AndImportModule -ModuleName $module
    }

    # 注册SecretVault（如果不存在）
    if (-not (Get-SecretVault -Name "MySecretVault" -ErrorAction SilentlyContinue)) {
        Register-SecretVault -Name "MySecretVault" -ModuleName "Microsoft.PowerShell.SecretStore" -DefaultVault
    }

    # 添加密钥（如果不存在）
    if (-not (Get-SecretInfo -Name "PnPAppClientId" -ErrorAction SilentlyContinue)) {
        Set-Secret -Name "PnPAppClientId" -Secret "Dont wanna show"
    }
    if (-not (Get-SecretInfo -Name "PnPAppTenantId" -ErrorAction SilentlyContinue)) {
        Set-Secret -Name "PnPAppTenantId" -Secret "Dont wanna show"
    }
    if (-not (Get-SecretInfo -Name "PnPAppSecret" -ErrorAction SilentlyContinue)) {
        $secureClientSecret = ConvertTo-SecureString "Dont wanna show" -AsPlainText -Force
        Set-Secret -Name "PnPAppSecret" -Secret $secureClientSecret
    }

    # 获取密钥
    $clientId = (Get-Secret -Name "PnPAppClientId").ToString().Trim()
    $tenantId = (Get-Secret -Name "PnPAppTenantId").ToString().Trim()
    $secureClientSecret = Get-Secret -Name "PnPAppSecret"

    # 调试输出
    Write-Host "Client ID: $clientId"
    Write-Host "Tenant ID: $tenantId"

    # 优化：使用ClientSecretCredential连接Microsoft Graph
    using namespace Azure.Identity
    $mgCredential = [ClientSecretCredential]::new($tenantId, $clientId, $secureClientSecret)
    Connect-MgGraph -Credential $mgCredential -TenantId $tenantId

    # 获取所有管理员角色
    $allRoles = Get-MgDirectoryRole -ErrorAction Stop

    # 存储结果的数组
    $results = @()

    # 遍历每个角色获取成员
    foreach ($role in $allRoles) {
        $members = Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id -ErrorAction Stop

        # 过滤掉服务主体
        $userMembers = $members | Where-Object { $_.AdditionalProperties.'@odata.type' -ne "#microsoft.graph.servicePrincipal" }

        # 批量获取用户详情
        $batchSize = 5
        $i = 0
        foreach ($batch in $userMembers | ForEach-Object -Begin { @() } -Process {
            $i++
            $_
            if ($i % $batchSize -eq 0) { $_ }
        }) {
            $batchFilter = "id in ('$(($batch.Id -join "','"))')"
            $users = Get-MgUser -Filter $batchFilter -Property Id, UserPrincipalName, DisplayName, Mail, JobTitle, Department -ErrorAction Stop
            foreach ($user in $users) {
                $results += [PSCustomObject]@{
                    RoleName = $role.DisplayName
                    UserPrincipalName = $user.UserPrincipalName
                    DisplayName = $user.DisplayName
                    Email = $user.Mail
                    JobTitle = $user.JobTitle
                    Department = $user.Department
                }
            }
        }
    }

    # 检查结果
    if ($results.Count -eq 0) {
        Write-Host "未找到任何结果。"
    } else {
        Write-Host "结果数量: $($results.Count)"
    }

    # 生成文件名和路径
    $fileName = "AdminReport_$((Get-Date).Year).csv"
    $filePath = Join-Path -Path $SavePath -ChildPath $fileName

    # 修复：使用PSCredential连接SharePoint
    $pnpCredential = New-Object System.Management.Automation.PSCredential ($clientId, $secureClientSecret)
    $siteUrl = "Dont wanna show"
    Connect-PnPOnline -Url $siteUrl -Credential $pnpCredential -Tenant $tenantId.Trim() -ErrorAction Stop

    # 保存为CSV文件
    Write-Host "正在保存结果到CSV文件: $filePath"
    $results | Export-Csv -Path $filePath -NoTypeInformation -ErrorAction Stop

    if (Test-Path $filePath) {
        Write-Host "CSV文件创建成功: $filePath"
    } else {
        Write-Host "创建CSV文件失败。"
    }

    # 上传文件到SharePoint文档库
    $libraryName = "Documents"
    $destinationPath = "Dont wanna show"
    Add-PnPFile -Path $filePath -Folder $libraryName -ErrorAction Stop

    # 发送Teams消息
    $message = @{
        text = "这是最新的全局管理员报告。点击此处打开文件: $destinationPath"
    }
    $jsonMessage = $message | ConvertTo-Json
    $webhookUrl = "dont wanna show"
    $response = Invoke-RestMethod -Uri $webhookUrl -Method Post -ContentType 'application/json; charset=utf-8' -Body $jsonMessage -ErrorAction Stop

    if ($response -eq "1") {
        Write-Host "消息发送成功。"
    } else {
        Write-Host "消息发送失败。"
    }

} catch {
    Write-Host "发生错误: $($_.Exception.Message)" -ForegroundColor Red
}

内容的提问来源于stack exchange，提问作者Philip Jambrisak