'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix SharePoint 401 Unauthorized with App-Only Authentication
Question details
The user needs to resolve a 401 Unauthorized error occurring in a C# SharePoint application after switching to app-only authentication.
- Product
- Microsoft SharePoint
- Device & OS
- not provided
- Scenario
- Developing a C# application using SharePoint APIs and transitioning from delegated authentication to app-only authentication.
- Observed behavior
- The application successfully issues an access token, but subsequent API calls to SharePoint return a 401 Unauthorized error.
Ensure you have Azure Active Directory (Entra ID) Administrator privileges to review, modify, and grant tenant-wide admin consent for application permissions.
Verify Application Permissions and Admin Consent
Ensure your Azure AD application is configured with 'Application' permissions (not Delegated) and that tenant-wide admin consent has been successfully granted.
When switching to app-only authentication, the context changes entirely. The application no longer acts on behalf of a user, meaning it relies strictly on the Application permissions granted in Azure AD. Without admin consent, the token generated will lack the necessary roles, leading to a 401 Unauthorized response from SharePoint.
Sign in to the Azure portal and navigate to Microsoft Entra ID (formerly Azure Active Directory), then select 'App registrations' and click on your application.
Navigate to the 'API permissions' blade. Click 'Add a permission', select SharePoint (or Microsoft Graph, depending on your endpoint), and choose 'Application permissions'.
Select the necessary permissions required for your app's operation (e.g., Sites.Read.All, Sites.Manage.All) and click 'Add permissions'.
Click the 'Grant admin consent for [Your Tenant]' button next to the permission list and confirm the prompt to apply the changes tenant-wide.
Check Token Audience and Application Roles
Validate that the generated access token contains the correct audience (aud) claim and the expected application roles.
Boost Your Development Workflow with WPS Office
While troubleshooting complex API integrations like SharePoint authentication, a lightweight and reliable office suite is essential for documenting code, tracking API specifications, and managing project plans. WPS Office provides a seamless, free alternative to Microsoft Office.
- 1. Visit the WPS Website: Go to the official WPS Office website using your web browser.
- 2. Download the Installer: Click the 'Free Download' button to get the latest version for your operating system.
- 3. Install and Launch: Run the downloaded installer and follow the quick setup instructions to start using your new office suite.
Frequently Asked Questions
Why do I get a 401 Unauthorized error only with app-only authentication?
Delegated authentication uses the permissions of the logged-in user, whereas app-only authentication relies entirely on Application permissions granted by an administrator. If the app permissions are missing, incorrect, or lack admin consent, SharePoint will reject the request with a 401 error.
Can I use client secrets for SharePoint app-only authentication in modern apps?
For Microsoft Graph APIs interacting with SharePoint, client secrets are generally supported. However, if you are connecting directly to SharePoint REST APIs or using CSOM via Azure AD app-only access, certificate-based authentication is strongly recommended and often required.
How can I check if my tenant allows custom app authentication for SharePoint?
Newer Microsoft 365 tenants disable ACS-based custom app authentication by default. If you are using ACS, you must enable it via the SharePoint Online Management Shell using the command: 'Set-SPOTenant -DisableCustomAppAuthentication $false'. However, migrating to Azure AD applications with certificates is the recommended modern approach.
