'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix HTTP 401 Errors When Connecting Azure App Service to SharePoint 2019
Question details
The user needs to resolve HTTP 401 authentication errors when attempting to connect an Azure App Service to an on-premises SharePoint Server 2019 utilizing Hybrid Connections.
- Product
- Azure App Service and SharePoint Server 2019
- Device & OS
- not provided
- Scenario
- Connecting an Azure App Service to on-premises SharePoint Server 2019 through Hybrid Connections using authentication tokens.
- Observed behavior
- The connection fails, returning HTTP 401 (Unauthorized) errors because username-and-password authentication or Azure AD access tokens are used without a compatible trust configuration.
Ensure you have administrative access to both the Azure App Service environment and the on-premises SharePoint Server 2019 farm, and have an appropriate X.509 certificate ready for configuration.
Configure High-Trust Server-to-Server Authentication
Set up an X.509 certificate to establish a high-trust relationship between your Azure App Service and on-premises SharePoint 2019 farm.
SharePoint Server 2019 cannot typically validate Azure AD tokens directly without appropriate integration. Bypassing HTTP 401 errors over Hybrid Connections requires implementing a high-trust authentication model using an X.509 certificate and Bearer tokens.
Ensure the App Management Service and Microsoft SharePoint Foundation Subscription Settings Service are properly configured and running on your SharePoint Server 2019 farm.
Use SharePoint Management Shell to configure your X.509 certificate as a trusted security-token issuer on the SharePoint 2019 server.
Register the application principal and grant it the required permissions within SharePoint to allow access from the Azure App Service.
Update the Azure App Service application code to generate certificate-signed JSON Web Tokens (JWTs) using the private key of your X.509 certificate.
Ensure your Azure App Service sends the generated JWTs as Bearer tokens in the HTTP Authorization header when making requests to the on-premises SharePoint APIs.
Looking for a Lightweight Alternative to Manage Your Documents?
While configuring complex SharePoint and Azure server environments, managing your daily document workloads shouldn't be a hassle. WPS Office offers a free, lightweight, and highly compatible alternative to Microsoft Office for creating and editing your team's documents seamlessly.
Frequently Asked Questions
Can I use Azure AD tokens directly with SharePoint 2019 on-premises?
Generally, SharePoint Server 2019 cannot validate Azure AD access tokens directly without a highly configured integration environment. It is recommended to use high-trust server-to-server authentication relying on an X.509 certificate instead.
Why am I getting an HTTP 401 error over an Azure Hybrid Connection?
This error typically occurs when the Azure App Service attempts to use standard username-and-password authentication or invalid Azure AD tokens against your on-premises SharePoint, rather than utilizing a properly configured high-trust security token.
What is a high-trust SharePoint add-in?
A high-trust add-in is a specifically configured application on a SharePoint on-premises environment that relies on digital certificates to establish a trust relationship. It allows the external application to authenticate securely via server-to-server communication using JWT Bearer tokens.
