I am writing an application (scheduled job) to bulk update SharePoint Online custom user profile properties using the SharePoint Online user profile bulk update API.

I am trying to use 'App Only' permissions when connecting to SharePoint Online and use the above API. Based on the article it looks like it is possible (See first question in FAQ in the article) but I am facing challenge in implementing it as I get 'access denied' no matter what permission I grant the client ID.

$workItemId = $o365.QueueImportProfileProperties($userIdType, $userLookupKey, $propertyMap, $importFileUrl);

Can someone point me to an same code/article that uses above API in app only context and what permissions do I have to assign on Azure AD and SharePoint.

1 Answer 1


I was able to access this api using app only context. Turns out client id requires access to social api. Navigate to sharepoint online admin center and then navigate to app permission page (/_layouts/15/appinv.aspx). Lookup the client id and then use below permission xml to grant access.

<AppPermissionRequests AllowAppOnlyPolicy="true" > 

        <AppPermissionRequest Scope="http://sharepoint/content/tenant" Right="FullControl" /> 

        <AppPermissionRequest Scope="http://sharepoint/social/tenant" Right="FullControl" /> 


This grants the app principal full control on the tenant and social api. The social api is important, without which bulk import api returns access denied.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.