I'm setting up a NEW O365 tenant developer SharePoint Online site to test the REST API using PostMan by following this.

I can successful setup Add-ins and generate access token, but when trying to access API with generated token, I got following error:

{"error":"invalid_request","error_description":"Token type is not allowed."}

Any help would be great appreciated! Thanks.


Rest request


enter image description here

  • Could you share the screen shot of PostMan?So we can see the REST you are using and the incoming data to reproduce this issue.
    – Amos
    Commented Sep 3, 2020 at 2:20
  • The same issue...
    – Ilya
    Commented Sep 8, 2020 at 11:39

5 Answers 5


Thanks @atupal, we received the same response from Microsoft yesterday and confirms it is working like a charm after enabling the tenant scoped property.

Recommend using Azure AD app-only model which is modern and securer

Our application is a multi-tenant application registered in AAD but due to the current permission scopes for SharePoint like "All Site Collections" how can this be more safe?`

@Amos_MSFT What is the real "security concerns" behind this undocumented change by Microsoft?

Are there plans to provide "per site collection" level scopes to help tell a better story to the concerned InfoSec Team at customers. Today we can only tell them to trust that the application don't misuse the All Site Collection level scope and start harvest information from e.g. OneDrive and other site collections on behalf of the user using the application?

It will not be a problem technically to change our application but the resistant from customers will be high when they now have to accept "Read and Write for All site collection" just because we allow uploading files into e.g. a document library on the site collection with our app installed. But when it is disabled by default we now need to start the whole installation process by convincing the customer that it is OK to enable it and for sure this is not gonna be easy - just remember when customer scripting was disabled by default for modern sites.

What are others thinking of this change and any insights of the long term plans from Microsoft on their permission scopes?


For new tenants ACS app-only is disabled by default. Recommend using Azure AD app-only model which is modern and securer. But you can change the behavior by running set-spotenant -DisableCustomAppAuthentication $false (upgrade to latest version if the command parameter is not found).


atupal's answer is correct and works like a charm. For detailed info.

For new SharePoint subscription Grant App Permission is disabled by default or the browser link https://xxxx-admin.sharepoint.com/_layouts/15/appinv.aspx is disabled. To enable this feature, we need to connect to SharePoint using Windows PowerShell and then run set-spotenant -DisableCustomAppAuthentication $false.

Run the following commands on PowerShell.

  1. Install-Module -Name Microsoft.Online.SharePoint.PowerShell
  2. $adminUPN="<the full email address of a SharePoint administrator account, example: [email protected]>"
  3. $orgName="<name of your Office 365 organization, example: contosotoycompany>"
  4. $userCredential = Get-Credential -UserName $adminUPN -Message "Type the password."
  5. Connect-SPOService -Url https://$orgName-admin.sharepoint.com -Credential $userCredential
  6. set-spotenant -DisableCustomAppAuthentication $false

Please note:

  • Fill in the values for the $adminUPN and $orgName variables (replacing all the text between the quotes, including the < and > characters), and then run the following commands at the SharePoint Online Management Shell command prompt:

  • When prompted with the Windows PowerShell credential request dialog box, type the password for the SharePoint admin account.

  • Afterward, run https://xxxx-admin.sharepoint.com/_layouts/15/appinv.aspx to grant permission

  • Generate new token and CRUD operations using REST API on SharePoint should be working by now.

Additional link: https://docs.microsoft.com/en-us/powershell/sharepoint/sharepoint-online/connect-sharepoint-online?view=sharepoint-ps

  • We have exactly the same problem (same tutorial, same error) and these steps solve the problem perfectly. Thanks for your help Commented Feb 9, 2021 at 15:34

This issue occurred only for new O365 tenants.Still it works for old O365 tenants. Any idea? We have created couple of trail account and verified.

I am also getting same error for new tenant.

{"error":"invalid_request","error_description":"Token type is not allowed."}


You should add access token in Headers. enter image description here Updated: enter image description here Or you could use this way to test rest api in postman:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.