SharePoint Online returns 401 for any call, right after getting access token

Question

I unable to perform any request to SharePoint Online via REST Api. It was used service high-trust authorization (App Only) to get access token. JSON Web Token, I've got, looks valid, see decoded version:

{
  u'ver': u'1.0',
  u'aud': u'https://<tenant>.sharepoint.com',
  u'roles': [
    u'User.Read.All',
    u'Sites.FullControl.All'
  ],
  u'iss': u'https://sts.windows.net/<some guid>/',
  u'oid': u'<some guid>',
  u'idp': u'https://sts.windows.net/<some guid>/',
  u'appidacr': u'2',
  u'aio': u'<some encoded data>',
  u'exp': 1510588040,
  u'appid': u'<some guid>',
  u'tid': u'<some guid>',
  u'iat': 1510584140,
  u'app_displayname': u'<Name of my OAuth application>',
  u'nbf': 1510584140,
  u'sub': u'<some guid>'
}

After getting access token, via jwt assertion, I was able to perform API calls to GraphAPI. The same approach was used for SharePoint Online but unfortunately all of requests (see bellow) returned 401 UNAUTHORIZED to me:

GET http://<tenant>.sharepoint.com/_api/web

GET http://<tenant>.sharepoint.com/_api/web/lists

Note: I tried it on a few Microsoft tenants, everything worked well except one tenant, I'm writing. I've already checked does my OAuth app got all required permissions and everything looks fine.

Probably it is a tenant related issue. I don't know where to dig in.

Answer 1

This appears to be similar to this problem with apponly tokens with some O365 tenancies.

https://social.msdn.microsoft.com/Forums/office/en-US/dc31f709-8783-4428-9bc8-0e6afb6b5287/cant-query-documents-using-apponly-token-the-label-thats-applied-to-this-item-prevents-it-from?forum=appsforsharepoint

https://office365.uservoice.com/forums/264636-general/suggestions/32235430