A developer in our organization has a console application that is exporting data into PDFs on one system, and then is uploading to a SharePoint Online document library. This works well, but the developer is using their account to authenticate.

Is there any type of 'service' account? We were told that resource accounts could possibly work, but that does not seem to be the case.

Or does this account need to be a paid-for licensed account that has permission to the team site?

It appears that a lot of Microsoft's documentation covers how to use the API, and you must authenticate, but not many more details that we have found on the limitations there.

Update: We are using ADFS, and do not have Azure AD.

  • I had a similar question regarding Flow in that as the developer we're creating Flows, but if our account is deactivated then the Flows no longer work. The answer to this is apparently Team Flows but it feels to me like a generic "Service" account would work better in these scenarios. Security is a consideration, but there should be ways around this. I'd like to see if you get a suitable answer. – Jacques Jun 27 '17 at 16:20
  • We're running into the same issue now. A console application being passed around with our own credentials. – Michael Colbs Jun 27 '17 at 16:35

Sure, you can create an account in Azure AD and designate it as a "service account" and use that account's credentials in the application. I recommend this approach. If the account is only going to access SharePoint, that account does not need to have an O365 license assigned to it. The benefit of using a service account is that you can assign it only the permissions it needs, and not being associated with a real user's identity means it's portable.

Another option is to use app-only policy, which requires configuring an app via appregnew.aspx and using a client ID/secret to authenticate.

  • Thank you. We aren't using Azure AD though, only ADFS. So I am unsure if we can go that route. Your second answer is something I saw, but didn't fully understand. This may work best for us - but for some reason I thought this was for more like webpart apps. Could a console app running on one of our servers do this too? – jmlumpkin Jun 28 '17 at 11:49
  • Reading that app-only policy, it appears that you still must use a username/pass, which would require a license. And I couldn't see how that tied into appregnew. – jmlumpkin Jun 28 '17 at 11:53
  • You don't need a license on either count. And yeah, app-only is a tough concept to understand, but not that complex once you get it. There's probably a blog post out there somewhere that lays it out. – Derek Gusoff Jun 28 '17 at 12:14
  • Thank you - I think I found more details on app-only, and it may work for our case. – jmlumpkin Jun 28 '17 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.