I have registered an App in my SharePoint Online, and I can use it's ID and secret with the Office Dev PnP PowerShell library. Works like a charm. Now the issue is that we are trying to connect to the SP site to grab some data from another app. We don't want to use OAuth2 with the user, we want to connect with this key/secret to get the data. Seamless to the user.

I tried the path of registering an app in Azure AD, used that id/secret and I do get a token! However, using my app's ID/secret I get a token too, using the following URL. I'd rather use my app in the site over a tenant app.


Getting a token with Postman

THEN I grab that access_token and try getting a list from the site using:


enter image description here enter image description here

The body response {"error_description":"Exception of type 'Microsoft.IdentityModel.Tokens.AudienceUriValidationFailedException' was thrown."}

and x-ms-diagnostics header from the response: 3000003;reason="Invalid audience Uri 'https://{tenant}.sharepoint.com/sites/test'.";category="invalid_client"

Here's the page that got me this far: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-service-to-service. And I tried http://www.andrewconnell.com/blog/user-app-app-only-permissions-client-credentials-grant-flow-in-azure-ad-office-365-apis but not sure where/how to use this cert with Postman. I think the solution, since it works with POSH, is using the App's id/secret in the site instead of the tenant, I don't want to have full access, just 1 site.

  • 1
    If I put an invalid token in my 2nd request, I get access denied. So it knows the token is 'good', but isn't letting me all the way – David Lozzi Apr 29 '17 at 21:57
  • See daemon or server to web API reference: docs.microsoft.com/en-us/azure/active-directory/develop/… – Glenn Ferrie May 1 '17 at 0:45
  • 1
    I'm too having the same issue do you got resolution for this problem? – JAVAC Nov 10 '17 at 14:40
  • 1
    I'm stuck with the same issue. Did you figure it out? – Niels Filter May 24 '18 at 7:32
  • Did any of you figure it out? I'm stuck on this also. – fei0x Sep 23 '19 at 18:57

It sounds like you have a working solution with SharePoint App Registration instead of using the Azure credentials.

To be sure, follow this:

  1. Register a new app at the site level with url/_layouts/15/appregnew.aspx and record the id and secret
  2. Add "access" for the app, specifically with AllowAppOnlyPolicy="true". Use url/_layouts/15/appinv.aspx (Permission XML Details)
  3. Use your app id and secret to authenticate any "App Only" client context. There is no user. It effectively elevates permission of anyone you give access to the "hosted" app, to whatever permissions you give it in step 2

I know you kind of already know most/all of this, but I just wanted to ensure you got these steps down pat. At that point, you should be good to go. Errors mean you're trying to use user context with app-only or vice versa. Be sure which one you're using. Doing this in POSTMAN is tricky. Check your headers and verify which flow (app only vs user context) you're using.

| improve this answer | |

There is no cross over between SharePoint app permissions and AzureAD app permissions.

You can use Office PnP libraries to access SharePoint with your clientID and client secret for your SharePoint app.

If you want to use AzureAD app permissions, you can only use Microsoft Graph.

| improve this answer | |
  • Do you believe this to still be true? Today when you add permissions to an app there is an entire section for the Sharepoint API with permissions like these: Sites.FullControl.All, TermStore.Read.All, User.ReadWrite.All I would have thought they were for the Sharepoint REST API given they refer to this resource: microsoft.sharepoint-df.com – fei0x Sep 23 '19 at 18:55
  • I guess you already know that those permission are for the Graph API, so they don't cross over. You can access SharePoint with Graph API but you can not use the client secret or client id from your AddIn. – Magnus Danielson Jun 10 at 11:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.