Connect to SharePoint Online from our console application when the "DisableCustomAppAuthentication is set to true"

Question

We have a lot of .Net console applications which run inside windows on-premises servers, which connect to SharePoint online using ClientID & ClientSecret and perform some background tasks, as follow:-

static void Main(string[] args)
        {
         string siteUrl = "https://*****.sharepoint.com/sites/HR/";
         string clientId = "1***";
         string clientSecret = ""******";
            
         using (ClientContext context = new OfficeDevPnP.Core.AuthenticationManager().GetAppOnlyAuthenticatedContext(siteUrl, clientId, clientSecret))
             try { 
                   {
                    context.Load(context.Web);
                    context.Load(context.Site.RootWeb.ContentTypes);
                    context.ExecuteQuery();

Now this code will not work on any tenant unless we set DisableCustomAppAuthentication to false as follow:-

Set-SPOTenant -DisableCustomAppAuthentication $false

Now on some tenants the admin refuse to enable the custom app authentication, so what are the other approaches that we have in this case, to authenticate our .Net console applications?

Answer 1

For new SharePoint online tenants, apps using an ACS app-only access token is disabled by default and Microsoft recommends using the Azure AD app-only model which is modern and more secure.

So, in this case you have two options as given below:

1. Using Azure AD app-only model (Recommended):

   Follow this documentation for detailed steps & use case: Granting access via Azure AD App-Only

2. Enabling Custom App Authentication (Not recommended & your tenant admins refusing to enable):

   Unfortunately, your second option is to enable the custom app authentication by setting DisableCustomAppAuthentication property using PowerShell command as given in your question.

   But, for SharePoint online tenants, Microsoft recommends using Azure AD app-only model for authentication instead of enabling custom app authentication.

---

Microsoft recently added Sites.Selected permissions in Azure AD application model which allows developers to switch from ACS based permissions provided in SharePoint via AppInv.aspx to Azure AD app-only model (Good thing you don't need to enable DisableCustomAppAuthentication in this case).

One more reason to avoid using ACS based permissions is SharePoint App-only service principals are not trackable (they all appeared as a [email protected] id in all logs) and hard to manage (there is no way to get list of existing/registered SP app-only service principals, sites and their owners)

Source: Testing Sites.Selected SharePoint and MS Graph API

Answer 2

Can you make a system user and connect with username and password?

 public ClientContext GetContext(string url)
 {
     var authenticationManager = new AuthenticationManager();
     var username = ConfigurationManager.AppSettings["SiteCollectionRequests_UserName"];
     var password = ConfigurationManager.AppSettings["SiteCollectionRequests_Password"];
     return authenticationManager.GetSharePointOnlineAuthenticatedContextTenant(url, username, password);
 }