Azure Synapse SharePoint Online List Linked Service

Question

Azure Synapse SharePoint Online List Linked Service

Doreen Cecil 40

Worked for years. Stopped working across UAT and PROD on the same day.

Error:

Failed to get metadata of odata service.

Expected status code: 200

Actual status code: Unauthorized

{"error":"invalid_request"}

Troubleshooting:

Service principal sign-in logs show SUCCESS.
Resource = Office 365 SharePoint Online.
_api/web succeeds.
_api/web/lists succeeds.
DisableCustomAppAuthentication = False.
App permissions:

Sites.Read.All

Sites.Manage.All

Sites.FullControl.All

Admin consent granted.

Manual token test:

Successfully acquired SharePoint token using client_credentials.

SharePoint returns:

"Unsupported app only token."

Question:

Has anyone seen Synapse SharePoint Online List connector failures resulting from ACS retirement or SharePoint rejecting Entra app-only tokens with 'Unsupported app only token'?

Pilladi Padma Sai Manisha 11,715 Reputation points Microsoft External Staff Moderator

2026-07-07T21:07:09.89+00:00
Hi @Doreen Cecil

Thank you for the detailed information and for outlining the troubleshooting you've already completed.

Based on what you've shared, we can see that the service principal is able to authenticate successfully and obtain an access token. However, the Synapse SharePoint Online List linked service receives a 401 Unauthorized response with the message "Unsupported app only token" when attempting to access the SharePoint endpoint.

At this stage, we cannot conclude that this is a SharePoint-specific issue. Since the failure occurs through the Azure Synapse SharePoint Online List linked service, we'd like to first investigate whether there has been any change in the connector's authentication behavior or how the token is being presented to SharePoint.

To help us investigate further, could you please provide the following details?

Synapse workspace name and Azure region.

Subscription ID.

Name of the affected linked service.

Pipeline Run ID and Activity Run ID from a recent failed execution.

Approximate UTC timestamp of the failure.

Confirmation of whether the issue affects all SharePoint Online List linked services or only specific ones.

Whether any changes were made to the Synapse workspace, linked service configuration, or Microsoft Entra application before the issue began.

Once we receive this information, we'll review the connector behavior and determine whether this is related to the Synapse connector or whether additional engagement with the SharePoint team is required.

We appreciate your cooperation and look forward to your response.
Pilladi Padma Sai Manisha 11,715 Reputation points Microsoft External Staff Moderator

2026-07-08T18:52:43.67+00:00

Hi @Doreen Cecil
I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.
Doreen Cecil 40 Reputation points

2026-07-08T18:55:17.24+00:00

Hello, Pilladi. I provided the requested information in the private chat. i do not see any other additional information except that you were investigating.
Doreen Cecil 40 Reputation points

2026-07-08T19:01:56.5266667+00:00

We are using Service principal key (legacy). We have begun switching the linked service to certificate. thank you for your help.

Answer accepted by question author

0 additional answers

Your answer

Pilladi Padma Sai Manisha 11,715 Reputation points Microsoft External Staff Moderator

2026-07-07T21:07:09.89+00:00

Hi @Doreen Cecil

Thank you for the detailed information and for outlining the troubleshooting you've already completed.

Based on what you've shared, we can see that the service principal is able to authenticate successfully and obtain an access token. However, the Synapse SharePoint Online List linked service receives a 401 Unauthorized response with the message "Unsupported app only token" when attempting to access the SharePoint endpoint.

At this stage, we cannot conclude that this is a SharePoint-specific issue. Since the failure occurs through the Azure Synapse SharePoint Online List linked service, we'd like to first investigate whether there has been any change in the connector's authentication behavior or how the token is being presented to SharePoint.

To help us investigate further, could you please provide the following details?

Synapse workspace name and Azure region.

Subscription ID.

Name of the affected linked service.

Pipeline Run ID and Activity Run ID from a recent failed execution.

Approximate UTC timestamp of the failure.

Confirmation of whether the issue affects all SharePoint Online List linked services or only specific ones.

Whether any changes were made to the Synapse workspace, linked service configuration, or Microsoft Entra application before the issue began.

Once we receive this information, we'll review the connector behavior and determine whether this is related to the Synapse connector or whether additional engagement with the SharePoint team is required.

We appreciate your cooperation and look forward to your response.
Pilladi Padma Sai Manisha 11,715 Reputation points Microsoft External Staff Moderator

2026-07-08T18:52:43.67+00:00

Hi @Doreen Cecil
I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.
Doreen Cecil 40 Reputation points

2026-07-08T18:55:17.24+00:00

Hello, Pilladi. I provided the requested information in the private chat. i do not see any other additional information except that you were investigating.
Doreen Cecil 40 Reputation points

2026-07-08T19:01:56.5266667+00:00

We are using Service principal key (legacy). We have begun switching the linked service to certificate. thank you for your help.

Answer 1

@Doreen Cecil Based on the behavior you've described, this does appear to be consistent with the retirement of Azure ACS authentication for SharePoint Online.

Although the service principal authentication and token acquisition succeed, the SharePoint Online List connector ultimately receives an unauthorized response when accessing metadata. The "Unsupported app only token" response from SharePoint typically indicates that the authentication method being used is no longer accepted for SharePoint Online.

Could you please confirm which authentication method is configured in the Synapse SharePoint Online List linked service?

Service principal key (legacy)
Service principal certificate (recommended)

If the linked service is still using Service principal key (legacy) or the authentication flow relies on the Azure ACS endpoint (https://accounts.accesscontrol.windows.net/...), we recommend migrating to Microsoft Entra ID App-Only authentication using a certificate, which is the supported authentication model following Azure ACS retirement.

References:

SharePoint Add-ins and Azure ACS retirement FAQ: https://learn.microsoft.com/sharepoint/dev/sp-add-ins/add-ins-and-azure-acs-retirements-faq
Granting access via Microsoft Entra ID App-Only: Granting access via Entra ID App-Only | Microsoft Learn