I am trying to understand how the authentication works using a .NET core application to O365. The article here describes it: https://docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/using-csom-for-dotnet-standard But it requires registering an app AND providing user name and password. My question is, why do I need to provide username and password with the authentication if we're registering an app already? What's the use of registering an app if we'll pass username and password anyway?


1 Answer 1


since you mention you are using .netcore i assume its a stand alone webapp and not a provider hosted app. If that is the case you can simply implement OAuth for authenticating your user with Azure AD. It doesn't need username and password, but a ClientID and a Client Secret to interact. The link you shared uses credentials just for demo purpose.

Now Why the AAD app is needed? For this you need to understand Authorization code flow. The AAD app helps you for requesting access token for you. You will have to configure appropriate API permissions that you will need to access within you .netcore application.

This can simply work as

string siteUrl = "https://tenant.sharepoint.com/sites/mysite";
using (var cc = new AuthenticationManager().GetAppOnlyAuthenticatedContext(siteUrl, "[Client_ID]", "[Client_Secret]"))
    cc.Load(cc.Web, p => p.Title);

You can better understand this with below image enter image description here

  • Thanks Akshay. I understand the clients credentials flow, but my confusion is if it needs to implement client credentials, why a username and password was also required ALONG WITH client credentials?
    – B1B
    Commented Sep 10, 2020 at 16:56
  • It's not required. The article link you refer just describes it as a alternative to clientid and client secret Commented Sep 10, 2020 at 17:11
  • Got it. Thanks for the clarification Akshay!
    – B1B
    Commented Sep 10, 2020 at 18:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.