Microsoft 365 Error Codes

Fix SharePoint Online CSOM OAuth 401 Unauthorized Error

Chanuka Geekiyanage Oct 9, 2026 868 views

Question details

The user is encountering a 401 Unauthorized error when making CSOM OAuth requests to SharePoint Online using app-only authentication, despite Microsoft Graph requests succeeding.

How to Fix SharePoint Online CSOM OAuth Requests Returning 401 Unauthorized

Product: SharePoint Online
Device & OS: not provided
Scenario: Executing Client-Side Object Model (CSOM) requests authenticated via OAuth with a client-secret or certificate.
Observed behavior: The SharePoint CSOM request fails with a 401 Unauthorized error, whereas interactive SharePoint authentication and Microsoft Graph API calls function correctly.

Before you start

Ensure you have Global Administrator or Application Administrator privileges in your Azure Active Directory tenant to review and modify the API permissions for your application registration.

Solution 1Recommended

Verify Azure AD App Permissions and Grant Admin Consent

CSOM OAuth requests using certificate or client-secret require specific application-level permissions in Azure AD that must be explicitly granted by an administrator.

While Microsoft Graph API handles its own permission scopes, legacy SharePoint CSOM endpoints require distinct permissions under the 'SharePoint' API category in Azure AD. App-only authentication flows strictly require 'Application permissions' rather than 'Delegated permissions'.

Access App Registrations

Modify API Permissions

Select your application, click on 'API permissions', and select 'Add a permission'. Choose 'SharePoint' from the Microsoft APIs list.

Select Application Permissions

Click 'Application permissions' (not Delegated) and check the necessary scopes, such as 'Sites.FullControl.All' or 'Sites.Selected', then click 'Add permissions'.

Grant Tenant Admin Consent

Click the 'Grant admin consent for [Your Tenant]' button above the permissions list and confirm. The status column must show a green checkmark for the changes to take effect.

Verify Azure AD App Permissions and Grant Admin Consent

Certificate Requirement for Certain Scopes: Microsoft currently enforces certificate-based authentication (instead of a simple client-secret) for high-privilege SharePoint application permissions like Sites.FullControl.All. Ensure your OAuth flow uses the uploaded certificate.

Solution 2

Consult the SharePoint Development Community

If permissions and admin consent are correctly configured, the OAuth flow or certificate configuration may require specialized review.

Free Microsoft Office alternative

Try WPS Office for Your Everyday Document Needs

While resolving complex SharePoint and Microsoft 365 development issues, consider using WPS Office as a lightweight, reliable alternative for your daily document creation and editing. It offers high compatibility with mainstream office formats without the heavy overhead.

1. Download the Installer: Visit the official WPS Office website and click 'Download WPS Office Free' to get the installer for your operating system.
2. Install WPS Office: Run the downloaded installer file, agree to the terms, and click 'Install' to begin the fast installation process.
3. Open Your Documents: Launch WPS Office. You can instantly open, edit, and save your existing Microsoft Office files with perfect formatting preservation.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Free and lightweight alternative to heavy Microsoft 365 client installations.Intuitive, tabbed user interface for seamless multi-document management.Built-in PDF editing, conversion, and annotation tools at no extra cost.

microsoft office alternative - wps office

Frequently Asked Questions

Why does Microsoft Graph authentication work while SharePoint CSOM fails with a 401 error?

Microsoft Graph and legacy SharePoint CSOM use different resource endpoints and API permissions. A token generated for Microsoft Graph (resource: graph.microsoft.com) cannot be used to authenticate a CSOM request (resource: yourtenant.sharepoint.com). You must acquire a separate token specifically for the SharePoint resource.

Do I need admin consent when using a client secret for SharePoint authentication?

Yes. When using app-only authentication (client secret or certificate), you are utilizing 'Application permissions' rather than delegated user permissions. These high-level permissions always require a global or application administrator to explicitly grant admin consent in Azure AD.

Can I use a client secret for SharePoint CSOM App-Only authentication?

Microsoft has blocked the use of client secrets for app-only authentication using ACS (Access Control Service) in new tenants. For modern Azure AD app-only authentication against SharePoint CSOM, you are required to use certificate-based authentication.

Microsoft Office Error Codes