We are making an interface with SharePoint. I did the app registration in AAD, gave SPO degelated permissions via Graph API

API call for access token works fine API call to get a file keeps erroring with a 403 forbidden.

Error message: 917656; Access+denied.+Before+opening+files+in+this+location%2c+you+must+first+browse+to+the+web+site+and+select+the+option+to+login+automatically.

Google doesn't help me any further... Maybe you guys can help me out?

SharePoint Online


1 Answer 1


For all you guys stumbling upon the same issue. This did the trick for us.


Since we were providing access to the WHOLE tenant and not just a site or sitecollection we needed to set the permissions on the tenant-admin-url

Literally the passage:

So what changed? Well, MS has recently made a change, which seems to have gone quietly. If you need any tenant level permission for your App only provider hosted app, you need to add permission in tenant admin site and not in any of the site collection! Well lets try that then…

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.