I have been able to successfully use the ADAL library to obtain an access token to SharePoint Online and execute CSOM queries. When I try to access a SharePoint Online URL directly using a WebRequest, I get a 401 error even though I am setting the authentication header with my bearer token.

When I manually use a web browser to access the URL, everything works. Upon further digging with Fiddler, I see the browser is somehow receiving/using the "rtFa" and "FedAuth" cookies. How can I do the same?

  • It is not clear from your question if you using REST api or SPO c# sdk. You mention bearer token so assuming you are using oauth. Can you please clarify which sdk are you trying to use and how exactly are you trying to authenticate.
    – sssreddy
    Sep 10, 2018 at 20:38
  • I'm using the Azure ADAL library to obtain access tokens and the SharePoint Online CSOM library to execute queries. I subscribe to the ClientContext's ExecutingWebRequest event where I assign the access token in the WebRequest's headers. This works great...no problems. The problem I run into is when I try to access a SharePoint document ID URL by directly using a WebRequest. It works if I authenticate by obtaining a SAML token and getting the authentication cookies, but not with an access token.
    – Steve
    Sep 10, 2018 at 20:53

2 Answers 2


OAuth access tokens work only with SharePoint APIs (_api/*, client.svc). All CSOM requests go through the client.svc, that's why it works fine with adal access tokens. However, it will never work if you try to load a document by url directly with WebRequest object and oauth access token.

You have two options here:

  1. Either attach cookies to your WebRequest and download file. This option has one caveat that you need a real account to obtain cookies, you also should store credentials in your application.
  2. Or use SharePoint search via CSOM to find your document by its documentId (you can extract it from query string, like DocIdRedir.aspx?ID=(document_id)). You should search by the managed property called DocId. Like here for example. However in your case the query will be keywordQuery.QueryText = "DocId:<your document id>";. In the search results you should find the real url of the file. Use CSOM to download the file from a web by its url.
  • I did try using the search service via CSOM, but it was not reliable for me. I did not want to go with a solution that depended on the search service completing its crawl of the SharePoint data. I saw this post which led me to believe it might be possible to obtain the auth cookies once I had an access token. Is it possible?
    – Steve
    Sep 10, 2018 at 21:51
  • Nope, that's 100% not possible Sep 10, 2018 at 22:10

You do not need ADAL library if you are using SharePoint Online C# sdk. Install the nuget package 'AppForSharePointOnlineWebToolkit' and it should install TokenHelper.cs and sharepointcontext.cs. Add app settings for ClientId and ClientSecret . Then use below code

            //Get access token
            string realm = TokenHelper.GetRealmFromTargetUrl(new Uri(siteUrl));
            string accessToken = TokenHelper.GetAppOnlyAccessToken(TokenHelper.SharePointPrincipal, (new Uri(siteUrl).Authority), realm).AccessToken;

            using (var ctx = TokenHelper.GetClientContextWithAccessToken(siteUrl, accessToken))
                // Your code here

Update: Based on your comments the Pnp Core component from Pnp should solve your problem. Please refer to this link from msdn that shows how to use pnp to get browser pop up. Some of the screenshots are old but the code remains the same. Also please refer to app registration information here.

  • Well, I decided to use ADAL so that I could handle MFA. At the time, it seemed to be the best choice so I went with it. As I said, it is working for me with the exception of accessing URLs directly.
    – Steve
    Sep 10, 2018 at 21:42
  • This approach will work with MFA enabled. Sep 11, 2018 at 13:37
  • What about federated accounts?
    – Steve
    Sep 11, 2018 at 15:43
  • Also, how does it handle MFA? Does it open a browser window like ADAL does?
    – Steve
    Sep 11, 2018 at 15:54
  • The above code does not use user credentials. It uses client id (app id) and client secret and runs in App-Only context. Please refer to this link for more information docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/… .
    – sssreddy
    Sep 11, 2018 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.