I have registered an App in my SharePoint Online, and I can use it's ID and secret with the Office Dev PnP PowerShell library. Works like a charm. Now the issue is that we are trying to connect to the SP site to grab some data from another app. We don't want to use OAuth2 with the user, we want to connect with this key/secret to get the data. Seamless to the user.

I tried the path of registering an app in Azure AD, used that id/secret and I do get a token! However, using my app's ID/secret I get a token too, using the following URL. I'd rather use my app in the site over a tenant app.


Getting a token with Postman

THEN I grab that access_token and try getting a list from the site using:


enter image description here enter image description here

The body response {"error_description":"Exception of type 'Microsoft.IdentityModel.Tokens.AudienceUriValidationFailedException' was thrown."}

and x-ms-diagnostics header from the response: 3000003;reason="Invalid audience Uri 'https://{tenant}.sharepoint.com/sites/test'.";category="invalid_client"

Here's the page that got me this far: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-service-to-service. And I tried http://www.andrewconnell.com/blog/user-app-app-only-permissions-client-credentials-grant-flow-in-azure-ad-office-365-apis but not sure where/how to use this cert with Postman. I think the solution, since it works with POSH, is using the App's id/secret in the site instead of the tenant, I don't want to have full access, just 1 site.

  • 1
    If I put an invalid token in my 2nd request, I get access denied. So it knows the token is 'good', but isn't letting me all the way Apr 29, 2017 at 21:57
  • See daemon or server to web API reference: docs.microsoft.com/en-us/azure/active-directory/develop/… May 1, 2017 at 0:45
  • 1
    I'm too having the same issue do you got resolution for this problem?
    – JAVAC
    Nov 10, 2017 at 14:40
  • 1
    I'm stuck with the same issue. Did you figure it out? May 24, 2018 at 7:32
  • Did any of you figure it out? I'm stuck on this also.
    – fei0x
    Sep 23, 2019 at 18:57

3 Answers 3


There is no cross over between SharePoint app permissions and AzureAD app permissions.

You can use Office PnP libraries to access SharePoint with your clientID and client secret for your SharePoint app.

If you want to use AzureAD app permissions, you can only use Microsoft Graph.

  • 1
    Do you believe this to still be true? Today when you add permissions to an app there is an entire section for the Sharepoint API with permissions like these: Sites.FullControl.All, TermStore.Read.All, User.ReadWrite.All I would have thought they were for the Sharepoint REST API given they refer to this resource: microsoft.sharepoint-df.com
    – fei0x
    Sep 23, 2019 at 18:55
  • 1
    I guess you already know that those permission are for the Graph API, so they don't cross over. You can access SharePoint with Graph API but you can not use the client secret or client id from your AddIn. Jun 10, 2020 at 11:18

It sounds like you have a working solution with SharePoint App Registration instead of using the Azure credentials.

To be sure, follow this:

  1. Register a new app at the site level with url/_layouts/15/appregnew.aspx and record the id and secret
  2. Add "access" for the app, specifically with AllowAppOnlyPolicy="true". Use url/_layouts/15/appinv.aspx (Permission XML Details)
  3. Use your app id and secret to authenticate any "App Only" client context. There is no user. It effectively elevates permission of anyone you give access to the "hosted" app, to whatever permissions you give it in step 2

I know you kind of already know most/all of this, but I just wanted to ensure you got these steps down pat. At that point, you should be good to go. Errors mean you're trying to use user context with app-only or vice versa. Be sure which one you're using. Doing this in POSTMAN is tricky. Check your headers and verify which flow (app only vs user context) you're using.


Late to the discussion but after hours of reading, testing and troubleshooting I now read the error message

Exception of type 'Microsoft.IdentityModel.Tokens.AudienceUriValidationFailedException' was thrown."

as: "I can see that you have a token, that's good. However there is something wrong with it and I wont tell you what it is. Good luck :) //MS"

For me, it was the permissions on the App Add-in the whole time and this xml permission cheat sheet really helped me. It's fair that when not specifying a token, you get a 403 forbidden. But very confusing that when using the API with a token for an app that doesn't have permissiong required, you get a general Exception thown at you as you can see above.

I wanted to give the app full access to a specific site, but my problem was that I did navigate to


when I should have been on


when assigning permissions with this XML to the app:

<AppPermissionRequests AllowAppOnlyPolicy="true">  
  <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" 
   Right="FullControl" />

Another this I learned the hard way is that when assigning permission for an app on the tenant level. Make sure that you are on https://tenant-admin.sharepoint.com/_layouts/15/appinv.aspx and not https://tenant.sharepoint.com/_layouts/15/appinv.aspx...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.