'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix 401 Unauthorized in SharePoint Azure AD App-Only Authentication
Question details
The user is experiencing a 401 Unauthorized error when using Azure AD app-only authentication in a SharePoint application, specifically during the ExecuteQueryAsync call.
- Product
- Microsoft SharePoint
- Device & OS
- not provided
- Scenario
- Developing or running a SharePoint application that relies on Azure AD app-only authentication.
- Observed behavior
- The application throws a 401 Unauthorized error when attempting to execute queries using ExecuteQueryAsync.
Ensure you have administrative access to both your Azure Active Directory portal and your Microsoft SharePoint admin center to review app registrations and permissions.
Verify Application Credentials and Azure AD Permissions
Check that your Azure AD app registration has the correct tenant ID, client ID, certificate thumbprint, and SharePoint permissions configured.
A 401 Unauthorized error during ExecuteQueryAsync typically indicates that the authentication token is invalid or lacks the necessary scopes. This happens when there is a mismatch in the Azure AD application credentials, an expired certificate, or missing admin consent for SharePoint application permissions.
Log in to the Azure Portal, navigate to Azure Active Directory > App registrations. Select your application and verify that the Application (client) ID and Directory (tenant) ID exactly match your code configuration.
Go to 'Certificates & secrets' in the app registration menu to ensure your uploaded certificate is valid and not expired. Confirm that the thumbprint matches your application's authentication configuration.
Navigate to 'API permissions' and check that the necessary 'SharePoint' permissions are granted under the 'Application' type (e.g., Sites.FullControl.All).
Ensure that the 'Grant admin consent for [Organization]' button has been clicked and successfully applied for the requested SharePoint permissions.
Consult the Microsoft Q&A SharePoint Development Community
If configuration checks do not resolve the issue, consult Microsoft specialists by providing your sanitized code and error logs.
Need a simpler way to manage your documents? Try WPS Office
While SharePoint and Azure AD are powerful for enterprise development, complex authentication errors can slow down your workflow. For everyday document creation, editing, and sharing, WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office. Enjoy a familiar interface without the heavy technical overhead.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install the Software: Run the downloaded installer file and follow the on-screen prompts to complete the setup process.
- 3. Launch WPS Office: Open WPS Office from your desktop or start menu to instantly begin creating or editing your documents, spreadsheets, and presentations.
Frequently Asked Questions
Why does Azure AD app-only authentication return a 401 error in SharePoint?
A 401 error typically occurs due to mismatched tenant IDs, invalid or expired certificates, incorrect certificate thumbprints, or missing admin consent for SharePoint application permissions in the Azure Portal.
How do I grant admin consent for my SharePoint app in Azure AD?
Go to your app registration in the Azure Portal, click on 'API permissions', add the necessary SharePoint application permissions, and then click the 'Grant admin consent for [Your Organization]' button.
Does WPS Office require Azure AD authentication to edit documents?
No, WPS Office is a standalone office suite. While it offers its own cloud synchronization features, it does not require complex Azure AD app-only authentication configurations to edit standard Office documents locally.
