I have a SharePoint application with a provider hosted app. User's can access Provider hosted app URL directly provided they have access to App and their user profile is created already.

I have a situation right now in production where user is added to SharePoint group but his user profile is not created and when he access Provider hosted app URL directly gets forbidden error.

ULS Log:

UserProfileException caught.. Exception Microsoft.Office.Server.Security.UserProfileNoUserFoundException: 3001002;reason=The incoming identity is not mapped to any user profile account in SharePoint. Possible cause is that no user profiles are created in user profile database. Contact your administrator.

Currently there is no CSOM/REST or JSOM way you can create user profile, only SSOM is supported which I cannot use in my prod.

Another solution can be to ask user to browse to SharePoint site first which will create user profile but this is just a work around.

Is there any way a Provider hosted app can ensure that user is created by some means if user profile doesnt exists?

  • Have you tested if the classic UPS web service (http://<<server>>/_vti_bin/userprofileservice.asmx) behave the same as way? Perhaps a long shot that the web service would create a user profile on the fly, but it may be worth a test. Sep 16, 2015 at 12:09

1 Answer 1


How about opening an (hidden) iframe targeting the MySite host?

Or requesting the MySite host from the provider-hosted app server-side code, by providing the user's token to the HTTP request?
Sample code (not tested, just for illustration purpose):

string ContextTokenString = TokenHelper.GetContextTokenFromRequest(Request);
SharePointContextToken ContextToken = TokenHelper.ReadAndValidateContextToken(ContextTokenString, Request.Url.Authority);
string AccessToken = TokenHelper.GetAccessToken(ContextToken,sharepointUrl.Authority).AccessToken;
HttpWebRequest listRequest = (HttpWebRequest)HttpWebRequest.Create("<MySiteHostURL>");
listRequest.Method = "GET";
listRequest.Headers.Add("Authorization", "Bearer " + accessToken);
  • I would redirect them to the My Site if you get the error. Sep 16, 2015 at 18:17
  • @Evariste- Thanks. Sounds like a good approach. Can you provide some example code snippet to do this in provider-hosted app server side code using user's token?
    – user12345
    Sep 18, 2015 at 7:23
  • I edited my answer.
    – Evariste
    Sep 18, 2015 at 11:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.