Have SharePoint 2013 with a provider hosted add-in hosted internally (not Azure,etc). I gave the app Full Control permissions on the site collection. It is basically the Visual Studio 2015 SharePoint Web Forms app with no modifications.

The Host site in SharePoint has "Everyone" given full read permissions.

I simply published the Add-In to a local IIS site. I then constructed the add-in url passing it a valid SPHostUrl of the SP site where the app was installed. Things are working fine, as long as the user that accesses the add-in site has also visited the SPHostUrl site. If the user has not visited the SPHostUrl site, the call to load the Web title fails with a 401 Unauthorized.

Is this a limitation of the Add-In model? Can I not access the SPHostUrl by way of provider hosted add-in if I have not actually visited the SharePoint site (or have a /catalogs/user entry there)?


  • Check the IIS web site. Does it have Anonymous access enabled? Does it have Windows Auth enabled? – Rodrigo Molinas Dec 22 '16 at 20:10
  • Windows Auth, Anonymous is off. – Brian Dec 28 '16 at 14:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.