Im developing a SharePoint provider hosted add-in and i thought about using NET Core2. That would mean "de-linking" from the Sharepoint Provider add-in (auto created in visual studio) and adding another type of auth.

Did anyone manage to contact SPO (on behalf of user) from a NET Core 2 app? I want the same functionality as the provider hosted add-in.

Any tips? Useful articles?


Update: I've rethinked my solution and i am now trying to get the accessToken from Azure AD (using the built in Auth from VS 2017) to contact SharePoint RestAPI.

Ive tried this, but the token i get is not on behalf of user, tehrefore not working (401 unauthorized)...

string clientId = 'xxxxxxxx';
string clientSecret = 'xxxxxxxxx'
var credential = new ClientCredential(clientId, clientSecret);

AuthenticationResult result = await authContext.AcquireTokenAsync("https://MYSITE.onmicrosoft.com/APPID", credential);

1 Answer 1


In general, it's possible to use ASP.NET Core web app as add-in web for provider hosted SharePoint add-in and it's not very difficult. The main issues are TokenHelper.cs and SharePointContext.cs, which use System.Web namespace, which is not available in .NET Standard. However, it can be easily replaced with classes from .NET Standard.

I've created a sample SharePoint (Online) add-in with ASP.NET Core 2.1 web app here.

How to run it


As you rightly mentioned SharePoint add-in project type will be unlinked. That's why F5 experience will not work. Instead, you should upload your add-in to SharePoint manually.

For that purpose, you should have developer site collection. Alternatively you can activate developer feature and enable sideloading of apps on an existing site collection using below PnP-PowerShell:

Connect-PnPOnline -Url https://org.sharepoint.com/sites/my-site
Set-PnPAppSideLoading -On
Enable-PnPFeature -Identity e374875e-06b6-11e0-b0fa-57f5dfd72085 -Scope Site

Steps to run the sample

  1. In VS press Ctrl+F5 to run the web app. You will see a web page with an error, it's ok because we haven't opened it from SharePoint yet. We just need to make sure that it's running.
  2. In your site collection go to _layouts/15/appregnew.aspx and register new app. For app domain use localhost:44316 (be aware that port might be different in your environment, so please check that port match the port from web app running from step #1), for redirect url https://localhost:44316/ (or from step #1)
  3. In SharePointAddIn project -> AppManifest.xml replace ClientId with one generated at step #2
  4. AddinWebApp -> appsettings.Development.json update ClientId and ClientSecret with values from step #2

  5. Right click on SharePointAddIn -> Publish -> Package. Upload .app file to App Packages library.

  6. Go to Apps in Testing library -> new app to deploy and deploy the app from step #5. Wait for the installation to be completed.
  7. You're' ready to go. Click on your app from Site Contents page and you will see the home page with your logged in SharePoint user in the middle of the page.


This solution is similar to OOB "SharePoint Addin" in VS. This solution works with SharePoint Online only (it's a lot more difficult to make it work for on-prem). The only differences from OOB project type are that SharePoint project is unlinked, ASP.NET Core 2.1 is used, TokenHelper and SharePointContext were modified a bit to support ASP.NET Core.

TargetFramework is set to net471, because SharePoint CSOM libraries aren't yet ported to .NET Standard, which means that you can't run this sample on Linux

Enjoy :)

If you use Azure ad authentication and have access token with user_impersonation scope, you can use on-behalf-of flow to exchange that token on an access token for another resource (SharePoint):

var userImpersonationAccessToken = "initial access token";

ClientCredential clientCred = new ClientCredential(ClientId, ClientSecret);
UserAssertion userAssertion = new UserAssertion(userImpersonationAccessToken);
//For production, use a Token Cache like Redis https://blogs.msdn.microsoft.com/mrochon/2016/09/19/using-redis-as-adal-token-cache/
var authContext = new AuthenticationContext(authority);
AuthenticationResult authResult = await authContext.AcquireTokenAsync("https://org.sharepoint.com", clientCred, userAssertion);
var spAccessToken = authResult.AccessToken;  

the token will be app+user

  • I've seen that before, but i dont really like the idea of targeting net471 in a NetCore2 app. Plus my idea was to unlink the app from sharepoint (so the user can follow a simple link instead of going through sharepoint). Do you have any tips on how i could get the access token for sharepoint through the built in Azure AUTH (vs2017) ? If not, can you please tell me if its even worth using the hack above for my app? (being a "hack" more than an actual supported solution i'm not really confident things will not break unexpectedly). I'll keep your solution as a last resort, thanks!
    – Dante R.
    Nov 4, 2018 at 10:37
  • Oh and also i am not a tenant admin so sideloading is not an option for me. I'm using Apps for Sharepoint at the moment and sideloading is against our internal policies
    – Dante R.
    Nov 4, 2018 at 10:38
  • If you want to use SharePoint CSOM, then you must target net471, because as said CSOM hasn't been ported to .NET Standard yet (the work is in progress right now). If you want to fully "unlink" an app from SharePoint then go ahead with Azure AD app. There is a .net library for that purpose. There is a sample with asp-core here. They call ms graph, but you should adjust sample to call Sharepoint Nov 4, 2018 at 10:46
  • Side loading is optional. You can use regular dev site instead of side loading. Nov 4, 2018 at 10:47
  • To be honest that was my first idea, to go with CSOM, but upon thinking on it CSOM might be a bit annoying due to the fact that you need strict values for each field and stuff. I'll take a look at the link you provided, many thanks.
    – Dante R.
    Nov 4, 2018 at 10:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.