Sharepoint online 'Unsupported app only token.'

Question

I got myself a bearer token by calling https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token with the scope https://{tenantName}.sharepoint.com/.default

It's a token for a registered app in Azure AD.

When I use that token to make an API call like https://infoinnobake.sharepoint.com/_api/search/query?querytext='contentclass:STS_Site contentclass:SP.Webb'&selectproperties='Title,Path'&rowlimit=500 I only reveice 401 Unsupported app only token.

can some explain why? Is it possible to access the sharepoint online API with an registered App on Azure AD?

Answer 1

Follow this guide right here: https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread

you need to create a certificate and upload the certificate to the registered app. Than you can use the API or the SharepointClient in various programming languages

Answer 2

We had a similar issue (with slightly different error message: 'Token type is not allowed') when using app-only, ClientID / ClientSecret based authentication in a tenant, that was recently created. In our old tenant (created in 2013) we could use the same authentication method without any problem. As it turned out, new tenants have a standard setting in DisableCustomAppAuthentication property, that disable this kind of auth., however it can be overriden using this command:

Set-SPOTenant -DisableCustomAppAuthentication $false

Source:

https://sharepoint.stackexchange.com/questions/284402/sharepoint-online-authorization-issue-token-type-is-not-allowed

https://sharepoint.stackexchange.com/questions/286693/getting-invalid-request-token-type-is-not-allowed-error-while-accessing-lists

Furthermore:

https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azureacs

Azure Access Control (ACS), a service of Azure Active Directory (Azure AD), has been retired on November 7, 2018. This retirement does not impact the SharePoint Add-in model, which uses the https://accounts.accesscontrol.windows.net hostname (which is not impacted by this retirement). For more information, see Impact of Azure Access Control retirement for SharePoint Add-ins. For new tenants, apps using an ACS app-only access token is disabled by default. We recommend using the Azure AD app-only model which is modern and more secure. But you can change the behavior by running ‘set-spotenant -DisableCustomAppAuthentication $false' (needs the latest SharePoint admin PowerShell).

More details:

https://www.koskila.net/literally-breaking-changes-to-app-authentication-on-sharepoint-%F0%9F%98%B5