I have an ASP.NET app that accesses SharePoint Online REST API using the SharePointOnlineCredentials class. The app was working for months, then recently started returning a 401 Unauthorized error. It appears that only programmatic access is being blocked, because if I log into SharePoint Online in a browser and execute a REST request directly, I get valid results back. I don't think it is user-specific, because at least two different apps that access SharePoint (using two different user IDs) are now returning an error.

I took a look in Fiddler, and the direct, in-browser request uses a FedAuth cookie for authentication. The programmatic request using the SharePointOnlineCredentials class doesn't show any cookie or Authentication header.

Here's the code I'm using:

webClient.Credentials = _Credentials; // SharePointOnlineCredentials object
webClient.Headers.Add("X-FORMS_BASED_AUTH_ACCEPTED", "f");
var uri = new Uri(restUri);
response = webClient.DownloadString(uri); // Returns 401

Something had to change that disallows programmatic access or a specific machine (the two apps tested are executing on the same server). Or, possibly, Basic Authentication got disabled/removed. I'm not really a "SharePoint guy", so I don't which, if any, of these are possibilities.

I asked our SharePoint admins, but so far they haven't uncovered any reason for this change in behavior. What could have changed that would suddenly deny access to all users when making a programmatic request in this way?

  • A password changed and your app doesn't know about it. – Derek Gusoff May 9 '18 at 13:23

Exact same issue for me! Slightly different code but same idea, been working for over a year then suddenly yesterday it stopped and reported 401 unauthorized on my response. I'm logging a ticket with Microsoft to get more info via our enterprise support contract. Will update this when I hear back, please do the same if you get any other feedback.

NOTE: Password is not an issue, I can run this call directly from the browser (chrome) but using the SharePoint.Client assembly its failing

string reqURL = _appSettings.ExtBaseURL + "/" + siteCollectionURL + "/_api/web/RoleAssignments/groups";

        HttpWebRequest wreq = (HttpWebRequest)HttpWebRequest.Create(reqURL);
        wreq.Method = "GET";
        wreq.Accept = "application/json;odata=verbose";
        wreq.Headers.Add("X-FORMS_BASED_AUTH_ACCEPTED", "f");
        wreq.Credentials = credentials;

        using (WebResponse webResponse = wreq.GetResponse())
  • I agree, it is not password, because I, too, can successfully execute in a browser, as indicated in my post. We are also considering opening a ticket with MS. I'll update if we do. – neizan May 9 '18 at 14:32
  • See my answer. – neizan May 9 '18 at 16:10

We received a response from MS regarding this issue just a few minutes ago:

We are aware of this situation and we are planning to make some changes to fix it in the course of next couple weeks. A workaround at this point is to pass in Cookies instead of Credentials.

$webSession.Cookies.SetCookies($siteURL, $authenticationCookies)

UPDATE Evidently MS fixed what they broke, because my app is working again, without having made any changes.

  • I just received the same email from them regarding my ticket. Checked my code and its working again! magic :) – Chris May 9 '18 at 21:13

I was getting this error and I traced it down to changing the assembly version from to some other number in the calling assembly. Changing my assembly back to made it work again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.