I am running a SharePoint Online provider-hosted app, and via CSOM, I am loading the contents of a list with the following code:

var items = List.GetItems(CamlQuery.CreateAllItemsQuery()); _clientContext.Load(items); _clientContext.ExecuteQueryAutoBackOff();

By using a ClientContext with a Bearer Token – ie. using the app model – the request fails. It doesn't matter what user is logged in. I can load properties of the list successfully eg. List.Title. Only CAML queries fail.

I am certain that I have access to this list. Additionally:

  • When constructing a ClientContext using a SharePointOnlineCredential object (specifying a username and password explicitly), the request succeeds.
  • The same user can view items in the browser.
  • All other lists, which have the EXACT SAME security permissions (ie. inheriting), return results successfully.
  • Breaking inheritance and explicitly assigning Full Control to Everyone makes no difference.
  • It was working previously, but I'm not sure at what point it stopped working. I don't think any changes have been made to either the code or the list.

What could be different about this list that causes Access Denied?

  • does the list has more than 5000 items?
    – Aveenav
    Commented Feb 1, 2016 at 22:34
  • Nope, about 20. Commented Feb 2, 2016 at 9:54

1 Answer 1


The cause was SharePoint behaviour. Here are the steps to reproduce:

  • Go into Term Store Management and create a custom termset.
  • Create a new site field based on that termset.
  • Add the field to the list. Add some list items with values from the termset.
  • Go into Term Store Management, edit the termset, and select Use this Term Set for Site Navigation.

At this point, attempting to query the list items via an app will result in Access Denied. Attempting to query the list items via any other mechanism is successful.

I believe this is a bug with either SharePoint or SharePoint Online only.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.