Today, we started getting errors when using KeywordQuery searches in our provider-hosted add-in (this is stable code that has been running for months). Intermittently, they seem to be going through. When it fails, we are getting a System.UnauthorizedAccessException.

The add-in has full site-collection permissions, and I've tried re-authorizing the add-in, as well as removing/reinstalling.

Below is an example of the code we're running (other calls to SharePoint using the token are working fine). Mostly I'm wondering if this is happening elsewhere, although perhaps it's too niche a case. It's going to be impossible to get MSFT support for this, I fear. Has there been some change that could cause this? Any ideas on how to get support would be welcome, too. This seems like an outage or something like ("some of our infrastructure was updated or is faulty...").

using (var context = GetClientContextWithAccessToken(url, clientToken))

                // Do keyword search by document id
                KeywordQuery kwQuery = new KeywordQuery(context);
                var queryTxt = $"UniqueId: {strGuid}";
                kwQuery.QueryText = "SPSiteUrl:\"" + url.ToLower().TrimEnd('/') + "\" AND (" + queryTxt + ")";
                kwQuery.RowLimit = 1;
                kwQuery.StartRow = 0;
                kwQuery.TrimDuplicates = false;

                SearchExecutor se = new SearchExecutor(context);
                ClientResult<ResultTableCollection> results = se.ExecuteQuery(kwQuery);
                context.ExecuteQuery(); // here is the error


1 Answer 1


It seems like there was a breaking change in provider-hosted app permissions. I can't find documentation of it anywhere.

This issue was fixed by explicitly requesting Search permissions for the add-in. So, I needed to add

<AppPermissionRequest Scope="http://sharepoint/search" Right="QueryAsUserIgnoreAppPrincipal" />

in the AppManifest.xml file. Once I granted it permissions in one location on the tenant, it worked across the tenant.

This permission had not been necessary for over a year until Tuesday.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.