Azure AD Permissions Error: Unable to Retrieve SharePoint List Items in .NET Core

Question

Hi Team,

To retrieve SharePoint list item details via .NET Core:

I have created a new “App registration” in the “Azure Active Directory” section and generated a client secret. I also granted the necessary API permissions (SharePoint sites “Read All”) and obtained admin consent.

After creating a new .NET Core project in Visual Studio, I used the client ID, tenant ID, and client secret to fetch SharePoint list details. However, I received an “Unauthorized” response.

Could you please review and provide suggestions to resolve this issue?

Answer 1

Hello @ArunKumar Arumugam,

Thank you for posting your query on Microsoft Q&A.Based on your description, it appears that you have created an application in Entra ID via app registration, generated a client secret, and added the "Sites.Read.All" API permission to the registered application under the "API Permissions" tab. You've also created a new .NET Core project in Visual Studio and are generating an access token using OAuth 2.0 client credentials flow. However, you're encountering an "Unauthorized" response when attempting to retrieve SharePoint list item details.

To troubleshoot this issue, here are some steps and suggestions:

1. Check Entra ID Application Permissions: Verify that the Azure AD application has the necessary API permissions to access SharePoint sites. You can check this by navigating to the Azure portal, selecting your Azure AD application, and reviewing the API permissions. Ensure you have added application permissions rather than delegated permissions for OAuth 2.0 client credential flow. Refer to the screenshot below for guidance.
2. Verify Authentication Process: Ensure that your .NET Core application is correctly authenticating with Azure AD and obtaining a valid access token. You can add logging to your application to output the access token and verify its validity. Alternatively, check the Microsoft Entra Sign-in logs for any failure reasons.
3. Grant Admin Consent: After adding API permissions, ensure that admin consent has been granted. This step is crucial for the permissions to be effective.
4. Confirm SharePoint Site URL: Verify that the SharePoint site URL you are trying to access is correct and accessible with the permissions granted to your Azure AD App Registration.
5. Capture Fiddler Trace: If the above steps do not resolve the issue, capture a Fiddler trace to inspect the HTTP requests and responses. This can help identify if the authentication token is correctly included in the request.

For guidance on capturing a Fiddler trace, refer to: https://learn.microsoft.com/en-us/power-query/web-connection-fiddler

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks,
Raja Pothuraju.