SharePoint Online REST API Authentication Update: Client Credential Deprecation

TL/DR

This document explains the latest Microsoft authentication changes affecting unattended integrations that call SharePoint Online REST API endpoints using OAuth 2.0 client credentials. It clarifies why client-secret-based app-only access can now fail with an Unsupported app-only token response and outlines the recommended migration path to Microsoft Entra ID applicatio¥p[;'\/n permissions with certificate-based authentication. Credits to Nico Popescu from Microsoft for explaining and guiding on next steps.

Introduction

Microsoft is continuing to retire legacy SharePoint Online authentication models and is enforcing more secure app-only authentication patterns for service-to-service access. The most important impact is that applications calling SharePoint Online REST or CSOM endpoints in an unattended context should use Microsoft Entra ID app-only authentication with a certificate, not a client secret. Microsoft documentation identifies the Entra ID application permissions model as the preferred approach for SharePoint Online app-only access, while the older SharePoint Azure ACS app-only model is retired and scheduled to stop working after April 2, 2026.

In practical terms, solutions that obtain a bearer token using only a client ID and client secret and then call SharePoint REST endpoints such as https://yourdomain.sharepoint.com/sites/SITENAME/_api/web may receive HTTP 401 responses. A common error message is Unsupported app only token. This behavior is expected when SharePoint rejects the token type for app-only REST access because the request is not using the supported certificate-based app-only pattern. However, when using Graph API endpoints, the URLs starting with https://graph.microsoft.com still support client credentials. But the overall recommendation is to use certificate-based authentication.

What Changed

Historically, many integrations used one of two app-only patterns to access SharePoint Online: the legacy SharePoint App-Only / Azure ACS model using appregnew.aspx and appinv.aspx, or a Microsoft Entra ID app registration using the OAuth 2.0 client credentials flow with a client secret. Microsoft is moving customers away from legacy and secret-based patterns because long-lived secrets are harder to protect, rotate, and govern. For SharePoint Online REST and CSOM app-only access, Microsoft’s current guidance is to use an Entra ID application registration with application permissions and certificate-based authentication.

This change is also aligned with the retirement of Azure ACS for SharePoint Online. Microsoft states that Azure ACS usage for SharePoint Online was retired on November 27, 2023 and will stop working for existing tenants after April 2, 2026. New tenants have already been affected by stricter defaults, and organizations should not build or extend new solutions on ACS or other legacy authentication approaches.

Observed Behavior in Postman or Custom Code

When testing with Postman, Azure Data Factory, PowerShell, Python, C#, or another integration platform, the application may successfully acquire an OAuth access token from Microsoft Entra ID. However, the SharePoint REST call can still fail because the token does not meet SharePoint’s requirements for app-only REST access. The typical response is HTTP 401 Unauthorized with a message similar to Unsupported app only token. In some scenarios, diagnostics may also indicate that the token type is not allowed due to SharePoint ACS retirement.

Supported Authentication Pattern

The supported pattern for unattended SharePoint Online REST API access is Microsoft Entra ID app-only authentication using a certificate. In this model, the application is registered in Microsoft Entra ID, granted SharePoint application permissions, and configured with a certificate credential. The application then requests a SharePoint-scoped token using the certificate and uses that token to call SharePoint REST endpoints.

For least-privilege access, Microsoft recommends using granular application permissions where possible, such as Sites.Selected, and then granting the application access only to the specific SharePoint sites it requires. Broader permissions such as Sites.Read.All, Sites.ReadWrite.All, or Sites.FullControl.All should be used only when there is a clearly justified business and security requirement.

Recommended Migration Approach

Inventory all scripts, Azure Functions, Power Automate custom connectors, Azure Data Factory pipelines, scheduled jobs, and applications that call SharePoint Online REST or CSOM endpoints using client secrets, ACS tokens, or SharePoint app-only principals.
Identify the target SharePoint sites, lists, libraries, and operations required by each integration. Classify access as read, write, manage, or full control.
Create or update a Microsoft Entra ID app registration for each integration or workload boundary. Avoid reusing a highly privileged shared app registration across unrelated processes.
Generate or obtain a certificate from an approved certificate authority or enterprise certificate process. Upload the public certificate to the app registration and securely store the private key in an approved secret store such as Azure Key Vault.
Grant the app the appropriate SharePoint application permissions. Prefer Sites.Selected when the integration only requires access to specific sites.
Grant site-level access to the application for each required SharePoint site. Validate the assigned permission level before production deployment.
Update the application code or platform configuration to authenticate using client ID, tenant ID, and certificate instead of client ID and client secret.
Test SharePoint REST calls against non-production sites first, then perform controlled production validation with monitoring and rollback planning.
Document the certificate expiration date, owner, rotation process, permission scope, and business justification for the integration.

Postman Validation Notes

Postman testing should not rely on a simple client secret token request for SharePoint REST app-only access. A token may be issued successfully, but SharePoint can still reject it when the token is presented to the REST endpoint. Validation should use a certificate-based client assertion flow or another supported implementation that signs the token request with the application certificate. The token audience should be SharePoint Online, for example https://yourdomain.sharepoint.com/.default, when calling SharePoint REST APIs.

Key Security Benefits

Reduced secret exposure: Certificates are better suited for confidential client automation than long-lived client secrets.
Improved governance: Entra ID app registrations provide centralized control, auditability, ownership tracking, and permission review.
Least-privilege access: Sites.Selected allows site-scoped access instead of broad tenant-wide permissions.
MFA-compatible automation: App-only certificate authentication supports unattended workloads without relying on user credentials or service account passwords.
Future readiness: Moving away from ACS and client-secret based patterns reduces risk from upcoming retirement milestones and policy enforcement changes.

Recommended Next Steps

Organizations should treat this as a high-priority modernization item. Any integration still using SharePoint ACS, appregnew.aspx/appinv.aspx, username-password authentication, or client-secret based app-only REST access should be assessed and migrated to Microsoft Entra ID application permissions with certificate-based authentication. For new development, avoid ACS and avoid designing unattended SharePoint REST integrations around client secrets. Where feasible, evaluate Microsoft Graph APIs for file and site operations, while recognizing that some SharePoint-specific administrative or list operations may still require SharePoint REST or CSOM.

Conclusion

The Unsupported app only token error is not simply a Postman issue or an API permission mismatch. It is commonly an indication that the integration is using an unsupported or no-longer-recommended token credential pattern for SharePoint Online REST app-only access. The durable remediation is to migrate the workload to Microsoft Entra ID app-only authentication using certificates, scoped permissions, and documented operational controls.