AuthenticationManager.GetAppOnlyAuthenticatedContext Azure App API permissions access denied

[Mathieu Marchant]

When building a ClientContext based on an App ID and ClientSecret, you get an access denied  while trying to access a SharePoint site. I have tried setting several API permissions, separately for SharePoint or Microsoft Graph, but the behavior stays the same.

var authManager = new AuthenticationManager();

using (var clientContext = authManager.GetAppOnlyAuthenticatedContext(siteUrl, _sharePointSettings.AppId, _sharePointSettings.AppSecret))
{
     clientContext.Load(clientContext.Web);
     clientContext.ExecuteQuery();
}

[#2]

@Mathieu Marchant Did you use this method to create the app id and secret - https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azureacs

If so what's the XML you used for the permissions?

[#3]

@Toby Statham I used the Azure Portal to register a new App under "Azure Active Directory" and from there I generated a new secret. Additionally I also added SharePoint related "API permissions" from there.

However I still get an access denied. So what I need to do, is lookup the app with the appinv.aspx from within SharePoint and add additional permissions from there with the xml.

What I would expect, is that setting the API permissions from the Azure Portal would be enough, but that doesn't seem to be the case. Is suppose by using the AuthenticationManager, the credentials are built up in a different way?

[#4 · Accepted solution]

If you're connecting to the SharePoint APIs using the Azure App registration you'll need to do it with a certificate as detailed here https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread

Otherwise use the method in my other post

[#5]

@Toby Statham 

Please make sure you granted appropriate API permission to Azure AD app for SharePoint. You can do it by going to Azure AD and then 'App Registration' and then 'API Permissions'. Under Microsoft APIs, select SharePoint and then provide either delegated or application permission based on your requirement.

[#6]

Does admin have given consent to your app??

For first time admin consent is required to use app created from azure portal app registration.

[#7]

@Rahul Suryawanshi The original poster had already done that, but was still getting an error. The problem is because a certificate needs to be created if you're accessing the SharePoint API using an Azure App registration (as detailed in the links I've provided in my replies). If you're using the GetAppOnlyAuthenticatedContext method you need to get the client id and secret through the SharePoint App registration method in AppRegNew.aspx

[#8]

@Toby Statham. Okay, Yeah, For the high trust, Sharepoint app requires certificate-based authentication. Thanks for pointing out to me.