Error: "SharePoint refused the app's sign-in for …"
An App ID connection was turned away by SharePoint: missing Sites.FullControl.All, consent not yet active, a client secret instead of a certificate, or a tenant policy.
What it means
The app signed in to Microsoft Entra ID with your App ID and certificate, but SharePoint did not accept the token. The rest of the message says why. Match it below.
| The message says | What to do |
|---|---|
| Give the app the SharePoint application permission Sites.FullControl.All and grant admin consent | In Entra admin center → App registrations → your app → API permissions → Add a permission → SharePoint → Application permissions → Sites.FullControl.All. Then Grant admin consent. (The Microsoft Graph permission with the same name is not enough.) |
| The app's token has no SharePoint application permissions … Admin consent granted just now? | New consent takes 5–10 minutes to reach new tokens. Wait, then click Test on the connection. Check that the Application (client) ID on the connection is the app you gave the permission to. |
| SharePoint does not accept a client secret – sign in with a certificate | SharePoint REST only accepts app-only tokens signed with a certificate. Create the certificate in the app (Connections → App ID → Create certificate) and upload the .cer file to the app registration. |
| The token does have … so SharePoint itself is blocking the app | The permissions are fine. A tenant setting blocks apps: an IP-address or unmanaged-device access policy, or app-only access turned off. Ask the SharePoint administrator. |
Only OneDrive is refused
If the message says the app works on tenant.sharepoint.com but not on tenant-my.sharepoint.com, a OneDrive-specific policy blocks it. See App refused on one site or OneDrive only.
Full setup steps: Connect with an App ID (certificate).
Was this article helpful?
Updated 2026-10-26