CSOM: Suddenly I can no longer ExecuteQuery due to 401 error

Question

I have successfully been using some CSOM based scripts, but suddenly the CSOM parts are no longer working.

For example, when executing the query below it errors with "(401) Unauthorized".

# Create internal and external document libraries
$listTitle = "Internal Files"

$listDescription = "Files stored in this library are only available to internal users only."
$listTemplate = 101

# Set SharePoint Online Credentials
$SPOCredentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($userName, $password)

# Creating client context object
$context = New-Object Microsoft.SharePoint.Client.ClientContext($url)
$context.Credentials = $SPOCredentials

# Create Internal 
$lci = New-Object Microsoft.SharePoint.Client.ListCreationInformation
$lci.title = $listTitle
$lci.description = $listDescription
$lci.TemplateType = $listTemplate
$list = $context.web.lists.add($lci)
$context.load($list)

# Send the request containing all operations to the server
try{
    $context.executeQuery()
    Write-Host "Created $($listTitle) library" -ForegroundColor Green
}
catch{
    Write-Host "Error: $($_.Exception.Message)" -ForegroundColor Red
}  

Of course I wondered if something had happened with the credentials, but I've tested them and it works. In fact, further up the script we do a Connect-SPOService using the same creds and it connects fine.

I can also run other scripts using the same credentials, but they are SPO commands not CSOM.

To confirm, the user account is an SPO admin.

Is there anything else I can check?

Thanks

Answer 1

My guess is the $SPOCredentials object is improperly formed. The $password argument needs to be a SecureString. Are you using Convert-ToSecureString on that somewhere upstream in the script?

Also, Check that your user account actually has access to the site. Just being an admin doesn't mean you have access to all the sites. Of course, you can grant yourself access.

One more thing - you really should consider using the PnP PowerShell CmdLets. They abstract away all the things that are giving you these problems. You can still retain the option to drop into CSOM - just run a Get-PnPContext and you've got your context object.