Azure Synapse SharePoint Online List Linked Service

Question

Azure Synapse SharePoint Online List Linked Service

Doreen Cecil 20

Worked for years. Stopped working across UAT and PROD on the same day.

Error:

Failed to get metadata of odata service.

Expected status code: 200

Actual status code: Unauthorized

{"error":"invalid_request"}

Troubleshooting:

Service principal sign-in logs show SUCCESS.
Resource = Office 365 SharePoint Online.
_api/web succeeds.
_api/web/lists succeeds.
DisableCustomAppAuthentication = False.
App permissions:

Sites.Read.All

Sites.Manage.All

Sites.FullControl.All

Admin consent granted.

Manual token test:

Successfully acquired SharePoint token using client_credentials.

SharePoint returns:

"Unsupported app only token."

Question:

Has anyone seen Synapse SharePoint Online List connector failures resulting from ACS retirement or SharePoint rejecting Entra app-only tokens with 'Unsupported app only token'?

Pilladi Padma Sai Manisha 10,945 Reputation points Microsoft External Staff Moderator

2026-07-07T21:07:09.89+00:00
Hi @Doreen Cecil

Thank you for the detailed information and for outlining the troubleshooting you've already completed.

Based on what you've shared, we can see that the service principal is able to authenticate successfully and obtain an access token. However, the Synapse SharePoint Online List linked service receives a 401 Unauthorized response with the message "Unsupported app only token" when attempting to access the SharePoint endpoint.

At this stage, we cannot conclude that this is a SharePoint-specific issue. Since the failure occurs through the Azure Synapse SharePoint Online List linked service, we'd like to first investigate whether there has been any change in the connector's authentication behavior or how the token is being presented to SharePoint.

To help us investigate further, could you please provide the following details?

Synapse workspace name and Azure region.

Subscription ID.

Name of the affected linked service.

Pipeline Run ID and Activity Run ID from a recent failed execution.

Approximate UTC timestamp of the failure.

Confirmation of whether the issue affects all SharePoint Online List linked services or only specific ones.

Whether any changes were made to the Synapse workspace, linked service configuration, or Microsoft Entra application before the issue began.

Once we receive this information, we'll review the connector behavior and determine whether this is related to the Synapse connector or whether additional engagement with the SharePoint team is required.

We appreciate your cooperation and look forward to your response.

Your answer

Pilladi Padma Sai Manisha 10,945 Reputation points Microsoft External Staff Moderator

2026-07-07T21:07:09.89+00:00

Hi @Doreen Cecil

Thank you for the detailed information and for outlining the troubleshooting you've already completed.

Based on what you've shared, we can see that the service principal is able to authenticate successfully and obtain an access token. However, the Synapse SharePoint Online List linked service receives a 401 Unauthorized response with the message "Unsupported app only token" when attempting to access the SharePoint endpoint.

At this stage, we cannot conclude that this is a SharePoint-specific issue. Since the failure occurs through the Azure Synapse SharePoint Online List linked service, we'd like to first investigate whether there has been any change in the connector's authentication behavior or how the token is being presented to SharePoint.

To help us investigate further, could you please provide the following details?

Synapse workspace name and Azure region.

Subscription ID.

Name of the affected linked service.

Pipeline Run ID and Activity Run ID from a recent failed execution.

Approximate UTC timestamp of the failure.

Confirmation of whether the issue affects all SharePoint Online List linked services or only specific ones.

Whether any changes were made to the Synapse workspace, linked service configuration, or Microsoft Entra application before the issue began.

Once we receive this information, we'll review the connector behavior and determine whether this is related to the Synapse connector or whether additional engagement with the SharePoint team is required.

We appreciate your cooperation and look forward to your response.