I've went through the following steps:

  1. Created an Azure AD application + client secret
  2. Granted SharePoint Sites.Selected permissions at Appplication level
  3. Given admin consent
  4. Granted FullControl to the app by using Grant-PnPAzureADAppSitePermission and Set-PnPAzureADAppSitePermission
  5. Generated the access token on endpoint https://accounts.accesscontrol.windows.net/{tenantId}/tokens/OAuth/2
  6. Used the token to access the site's REST API (e.g. _api/web)

I get 403 Forbidden. The response header x-ms-diagnostics has the value 3002002; reason=App principal does not exist.

What's going on here? Is Sites.Selected really supported for the SharePoint REST API or am I missing something else?


3 Answers 3


Got the confirmation from Microsoft support:

Can I use other means besides certificates for realizing app-only access for my Azure AD app?

No, all other options are blocked by SharePoint Online and will result in an Access Denied message.



I think the previous answer may be wrong. In our experience it works like below (regarding token endpoints):

Used for Graph API:


Used for SharePoint REST API v1:


for one site app we have x-ms-diagnostics with the value 3002002; reason=App principal does not exist.

Other sites and apps are working fine.


It works for sure. You should get the access token from the right end point. It should be https://login.microsoftonline.com/$YOURTenantName/oauth2/token. https://accounts.accesscontrol.windows.net/{tenantId}/tokens/OAuth/2 is the end point for getting the token from ACS which is valid only for those apps that have been registered via the appregnew page in the SharePoint site. Depending on the grant flow you will have to provide the right parameters (cliend id, secret or certificate credentials)

  • Your method gives 401: {"error_description":"Exception of type 'Microsoft.IdentityModel.Tokens.AudienceUriValidationFailedException' was thrown."}
    – Chris DS
    Feb 20 at 9:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.