Is Sites.Selected working with SharePoint REST API (and client secret)?

Question

I've went through the following steps:

1. Created an Azure AD application + client secret
2. Granted SharePoint Sites.Selected permissions at Appplication level
3. Given admin consent
4. Granted FullControl to the app by using Grant-PnPAzureADAppSitePermission and Set-PnPAzureADAppSitePermission
5. Generated the access token on endpoint https://accounts.accesscontrol.windows.net/{tenantId}/tokens/OAuth/2
6. Used the token to access the site's REST API (e.g. _api/web)

I get 403 Forbidden. The response header x-ms-diagnostics has the value 3002002; reason=App principal does not exist.

What's going on here? Is Sites.Selected really supported for the SharePoint REST API or am I missing something else?

Answer 1

Got the confirmation from Microsoft support:

Can I use other means besides certificates for realizing app-only access for my Azure AD app?

No, all other options are blocked by SharePoint Online and will result in an Access Denied message.

https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread#can-i-use-other-means-besides-certificates-for-realizing-app-only-access-for-my-azure-ad-app

Answer 2

I think the previous answer may be wrong. In our experience it works like below (regarding token endpoints):

Used for Graph API:

https://login.microsoftonline.com/$YOURTenantName/oauth2/token

Used for SharePoint REST API v1:

https://accounts.accesscontrol.windows.net/{tenantId}/tokens/OAuth/2 

---

for one site app we have x-ms-diagnostics with the value 3002002; reason=App principal does not exist.

Other sites and apps are working fine.

Answer 3

It works for sure. You should get the access token from the right end point. It should be https://login.microsoftonline.com/$YOURTenantName/oauth2/token. https://accounts.accesscontrol.windows.net/{tenantId}/tokens/OAuth/2 is the end point for getting the token from ACS which is valid only for those apps that have been registered via the appregnew page in the SharePoint site. Depending on the grant flow you will have to provide the right parameters (cliend id, secret or certificate credentials)