I am working on SharePoint Provider hosted app for SharePoint Online. The remote web application is deployed on Azure Web App service(azurewebsites.net) and configured authentication/authorization with Active Directory.

I have remote event receiver for item added event. When I add any item to list it get triggered but it get unauthorized error 401. Error details: The HTTP request is unauthorized with client authentication scheme 'Anonymous'. The authentication header received from the server was 'Bearer realm="xyz.azurewebsites.net"'.

If I enable Anonymous access to complete azurewebsites then remote event receiver get call.

Does anyone have faced this issue? Based on the error, SharePoint is calling RER with Anonymous scheme but azurewebsite is enabled with Active Directory Authentication. I tried allowing anonymous access to only AppEventReceiver.svc but that didn't worked.

web.config edits

    <location path="~/Services/AppEventReceiver.svc">
                <allow users="?"/>
 <!-- other elements -->

I had discussion with experts and they did talked with MS team. The authenticated RER have issues and they failed to get invoked.

Also, Azure Web app does not support 'Anonymous' access to particular resource through web.config.

So to fix this issue, I have to keep the Azure Web App configured with 'Anonymous' access and add additional security that Azure Web App only accessible from restricted IP addresses.

  • Hi Vikram, Im having some security concern with Anonymous access. Could you share how did u implement the IP Address Restriction ? – Eric Jun 11 '20 at 3:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.