The Scenario

I am developing a SharePoint provider hosted app. the SharePoint app web is only used as a repository for storing documents in document libraries and the web application use O365 multitenant app to authenticate users by using ADAL tokens. So all the CSOM calls are executed using app-only access token because acquiring the SharePoint user access token is not always possible since user can directly access our web application with out redirecting via SharePoint.

The Requirement

I need to provide functionality to the user to search the documents in the document library which is in the app web via SharePoint search. I'm using CSOM to execute search queries.

The problem.

The access privileges of the SharePoint app only token is not sufficient to access SharePoint search.

What I have tried

Since getting the user access token is not an option, I tried asking more permission in the app manifest.

Querying SharePoint search is possible if the app is granted "Scope:Tenant, Permission : Read".

A Sample Code that I used to test the search functionality

Uri targetWeb = new Uri("AppWebUrl");                     
var responseToken = TokenHelper.GetAppOnlyAccessToken(TokenHelper.SharePointPrincipal, targetWeb.Authority, targetRealm);
var ctx = TokenHelper.GetClientContextWithAccessToken("AppWebUrl", responseToken.AccessToken);
KeywordQuery keywordQuery = new KeywordQuery(ctx);
keywordQuery.QueryText = keywordQueryValue;
keywordQuery.RowLimit = 500;
keywordQuery.StartRow = 0;
SearchExecutor searchExec = new SearchExecutor(ctx);
ClientResult<ResultTableCollection> results = searchExec.ExecuteQuery("keywordQuery");


  1. Is it feasible to ask this level of permission from a customer when they are installing the app?

  2. Is there any way to access SharePoint search in my scenario other than asking Tenant Read permission?

If any one can shed some light on this it will be highly appreciated

Thank you

1 Answer 1


I don't think there is a way to query Search via app-only permissions. As a workaround you could use stored credentials and execute the Search using that context.

But you need to understand that Search relies on a proper user context to function properly. Unless your security implementation is really simplistic you are likely to see issues where users see documents they don't have access to, or vice versa.

Another thing, it sounds like that by bypassing authentication you are essentially opening up your application to the entire Internet (unless it is behind a firewall). Are you comfortable with the population at large being able to access your content?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.