I have a console application defined in Azure AD. It is based on this example: https://blogs.msdn.microsoft.com/richard_dizeregas_blog/2015/05/03/performing-app-only-operations-on-sharepoint-online-through-azure-ad/

Everything works fine while I'm using the certificate for accessing the SharePoint. What is unclear about it is why this solution does work with the certificate and does not work when using the ClientID and ClientSecret for authorization.. I get the access token in both cases but when I make queries, the certificate one is getting the results but the ClientSecret one gets unauthorized - all SharePoint permissions are given in the AzureApp.

I'd like to use ClientID/ClientSecret (generated on the Azure) instead of certificates.

//Working part of the code
ClientAssertionCertificate cac = new ClientAssertionCertificate(CLIENT_ID, cert);
var authenticationResult = await authenticationContext.AcquireTokenAsync("https://domain.sharepoint.com/", cert);

//not working
ClientCredential creds = new ClientCredential(CLIENT_ID, CLIENT_SECRET);
var authenticationResult = await authenticationContext.AcquireTokenAsync("https://domain.sharepoint.com/", creds);

both of these codes passes without error/exception.. but the first one gets results when executing context.ExecuteQuery() or rest_call, and the other one gets 401 - unauthorized..

Any help about it or explanation why is that so? (I know about appregnew.aspx etc.. I'd like to manage app through Azure and get clientSecret through Azure and not from Sharepoint Sites)

1 Answer 1


It is not possible to make app-only calls to SharePoint Online using only Client Secret and Client ID. You need to use a management certificate.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.