I have a external webservice that uses service account to login into sharepoint to access sharepoint apis.

The problem we had is that the password would expire every 3 month. We want to seek out a way that we can maybe use azure password vault or something to generate a permanent key that we can use to access sharepoint api.

I am not sure if this can be done or is possible. I dont even know where I can seek out resource for this. I have tried to convince security team to allow perma password but with no luck. Are there any solution which can bypass this password issue?

"Edit" I was able to generate token from clientId and clientSecret but I am getting error 403 when I tries to connect to it. HttpUrlConnection basically tries to run a search (query) api from sharepoint.

            HttpURLConnection url1 = (HttpURLConnection) new URL(path).openConnection();
            url1.setRequestProperty("Authorization", auth);
            url1.setRequestProperty("Accept", "application/json;odata=verbose");
            url1.setRequestProperty("X-FORMS_BASED_AUTH_ACCEPTED", "f");
            url1.setRequestProperty("Content-Type", "application/json;odata=verbose");
            for(Entry<String, List<String>> m : url1.getHeaderFields().entrySet()) {
                System.out.println("key: "+m.getKey());
                for(String v: m.getValue()) {
                    System.out.println("values: "+v);

1 Answer 1


There are a couple of ways to do this, but I'd recommend using an App-Only principal. The advantage of this approach is you can grant only the explicit permissions you need it to have. Implementation details are here:

If you don't need full tenant access but only want to scope your app to a single site, you can use the AppRegNew and AppInv pages as described in the linked doc, but on the intended target site instead.

  • I have tried this. My code is written in java. I have added the edit above...
    – logger
    Commented Jun 19, 2019 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.