I am running a SharePoint Online provider-hosted app, and via CSOM, I am loading the contents of a list with the following code:

var items = List.GetItems(CamlQuery.CreateAllItemsQuery()); _clientContext.Load(items); _clientContext.ExecuteQueryAutoBackOff();

By using a ClientContext with a Bearer Token – ie. using the app model – the request fails. It doesn't matter what user is logged in. I can load properties of the list successfully eg. List.Title. Only CAML queries fail.

I am certain that I have access to this list. Additionally:

  • When constructing a ClientContext using a SharePointOnlineCredential object (specifying a username and password explicitly), the request succeeds.
  • The same user can view items in the browser.
  • All other lists, which have the EXACT SAME security permissions (ie. inheriting), return results successfully.
  • Breaking inheritance and explicitly assigning Full Control to Everyone makes no difference.
  • It was working previously, but I'm not sure at what point it stopped working. I don't think any changes have been made to either the code or the list.

What could be different about this list that causes Access Denied?

  • does the list has more than 5000 items? – Aveenav Feb 1 '16 at 22:34
  • Nope, about 20. – johnnycardy Feb 2 '16 at 9:54

The cause was SharePoint behaviour. Here are the steps to reproduce:

  • Go into Term Store Management and create a custom termset.
  • Create a new site field based on that termset.
  • Add the field to the list. Add some list items with values from the termset.
  • Go into Term Store Management, edit the termset, and select Use this Term Set for Site Navigation.

At this point, attempting to query the list items via an app will result in Access Denied. Attempting to query the list items via any other mechanism is successful.

I believe this is a bug with either SharePoint or SharePoint Online only.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.