I have the following console application to connect to my online site:-

using Microsoft.SharePoint.Client;
using System;
using System.Linq;
using System.Security;
using System.Linq;
using System.Text;

namespace ConsoleApp1
    class Program
        static void Main(string[] args)
            string siteCollectionUrl = "https://***.sharepoint.com";
            string userName = "***@***.com";
            string password = "T*****";
            Program obj = new Program();
                obj.ConnectToSharePointOnline(siteCollectionUrl, userName, password);
            catch (Exception ex)
                string msg = ex.Message.ToString();



        public void ConnectToSharePointOnline(string siteCollUrl, string userName, string password)

            //Namespace: It belongs to Microsoft.SharePoint.Client
            ClientContext ctx = new ClientContext(siteCollUrl);

            // Namespace: It belongs to System.Security
            SecureString secureString = new SecureString();

            // Namespace: It belongs to Microsoft.SharePoint.Client
            ctx.Credentials = new SharePointOnlineCredentials(userName, secureString);

            // Namespace: It belongs to Microsoft.SharePoint.Client
            Site mySite = ctx.Site;



now the user i am trying to login with have 2 factor authentication enabled. so when i run the application, i got this exception "The sign-in name or password does not match one in the Microsoft account system" although i am passing valid username and password .. any idea?


2 Answers 2


Your account may be MFA (Multi-factor authentication) enabled! With MFA enabled, the method using class SharePointOnlineCredentials with username and password for authentication would not work.

You have only two options: Use user credentials with the OTP prompt or call. This needs to install the package SharePointPnPCoreOnline: https://www.nuget.org/packages/SharePointPnPCoreOnline.

 var authManager = new OfficeDevPnP.Core.AuthenticationManager();  
 // This method calls a pop up window with the login page and it also prompts  
 // for the multi factor authentication code.  
 ClientContext ctx = authManager.GetWebLoginClientContext(siteUrl);

Use app-only for authentication: https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azureacs

  • ok thanks .. but how i can reference OfficeDevPnP.Core.AuthenticationManager() i install those packages Install-Package PnP.Framework Install-Package PnP.Core but can not reference it and i am getting an error on OfficeDevPnP.Core.AuthenticationManager()
    – John John
    Mar 25, 2022 at 8:57
  • I hate to have to disagree with another contributor, but you should register the application with Azure Active Directory (AD), not Azure Access Control Services (ACS). Azure ACS is the authentication model used by SharePoint Add-ins, and the SharePoint team has been hinting that the Add-in model will be deprecated at some point in the not too distant future. This would mean that Azure ACS will be deprecated as well. Mar 25, 2022 at 9:24

This blog post describes how to register an app with Azure Active Directory (Azure AD), how to authenticate with Azure AD using the Microsoft Authentication Library (MSAL) to get an access token, an then how to use that access token to make SharePoint Client Object Model (CSOM) calls.

Calling SharePoint Online APIs using Azure AD App-Only permissions and certificate auth

I don't think the blog post calls this out, but you will need two Nuget packages to use the code shown in the blog post:



var token = await TokenProvider.GetAccessTokenAsync(new Uri(siteUrl).GetLeftPart(UriPartial.Authority));
using var context = new ClientContext(siteUrl);
context.ExecutingWebRequest += (sender, e) =>
    e.WebRequestExecutor.RequestHeaders["Authorization"] = "Bearer " + token;
context.Load(context.Web, web => web.Title);
await context.ExecuteQueryAsync(); 
  • WindsorRob Windsor i want to authenticate using username and password not using client Id and client secret.. thanks
    – John John
    Mar 25, 2022 at 9:24
  • 1
    There is no way to do this if the account has MFA enabled and you want the application to run unattended. You could use delegated permissions instead of application (app-only) permissions along with PublicClientApplication.AcquireTokenInteractive from the MSAL library to do something similar. If you do so, a login dialog will open every time you run the application. The user can use this login dialog to enter their credentials and perform the secondary authentication. Unfortunately, I don't have a resource that shows how to use this authentication method with CSOM. Mar 25, 2022 at 9:44
  • Windosr the console application will run attended .. manually by me
    – John John
    Mar 25, 2022 at 10:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.