I'm developing a SharePoint App that is provider-hosted.

Could I access to a site collection using App permission (this means using ProductID and IssuerID and etc) without StandardToken?

Usually the access model is like below:

  1. An user access to SharePoint site.
  2. The user perform any action (e.g. click custom button from app).
  3. An access URL with StandardToken from SharePoint to Provider was created.
  4. Provider parses the URL using SharePointContext.cs and accessed to SharePoint objects.

Now I would like to access SharePoint object from Provider without access to SharePoint site.

  1. An user access to a page from Provider.
  2. The user perform any action (e.g. click button in the page)
  3. Provider accesses to SharePoint Object and do some job.

The common method for this usage is Client Object Model. The authentication for this method uses User Profile Service, in my mind. This requires to save user id and password, and I want to avoid this way.

1 Answer 1


I guess what you are looking for is App Only Access to SharePoint. In this mode you can access SharePoint with App permissions only (your App has to request these permissions and at the time of installation these should be accepted). Check for option "Allow the app to make app-only calls to SharePoint" in your App's AppManifest file.

Once you App has these permissions, it can use TokenHelper.GetAppOnlyAccessToken to get the access token and use it to create the client context. This can be done completely outside of SharePoint then as you want to. All operations to SharePoint will then be performed in context of the App (not any user). Please read more here:


For completeness sake, I want to add here that this can also be achieved in the context of user by use of refresh tokens but it has some expiry so App only access might work better for you.

  • Thanks Prakash. It looks what I want, but in the example I have no idea what contextTokenString is. After look on GetContextTokenFromRequest, that seems to be provided using Form or QueryString, which means I need prepare it by web app self. Is it a fixed string for dynamic string? And how can I get it?
    – user48851
    Commented Dec 1, 2015 at 8:10
  • You need to know the Url of SP site, after that: Uri SharePointUri = new Uri(webURL); var accessToken = TokenHelper.GetAppOnlyAccessToken(TokenHelper.SharePointPrincipal, SharePointUri.Authority, TokenHelper.GetRealmFromTargetUrl(SharePointUri)); ClientContext clientContext = TokenHelper.GetClientContextWithAccessToken(webURL, accessToken.AccessToken);
    – Prakash
    Commented Dec 1, 2015 at 8:15
  • Now I understand the suggested way is for Low Trust model. After I changed var accessToken = line to var accessToken = TokenHelper.GetS2SAccessTokenWithWindowsIdentity(SharePointUri, null); for High Trust model, it works perfectly. Thanks a lot!
    – user48851
    Commented Dec 1, 2015 at 8:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.