How to fix unauthorized with logic app connector to sharepoint get file content

Question

How to fix unauthorized with logic app connector to sharepoint get file content

Michael Francis 0

I am trying to change the assigned user to a new user to run the automation created in my logic app and I get "unauthorized". I verified my user can access the sharepoint site but i get the following error and need help to correct the destination reference for my sharepoint that i am connected to modify so I can connect to another sharepoint I have access.

Error: 401

0 comments

1 answer

Your answer

Answer 1

Allan Solomon Mejia 8,085

Hello @Michael Francis

A 401 Unauthorized after changing the user usually means the Logic App's SharePoint action is still using the existing API connection/authentication context, not simply the permissions of the newly assigned user.

I would create or re-authenticate the SharePoint connection using the new account, then update the Get file content action to use that connection. Also reselect the Site Address and file/library after changing the connection rather than keeping references generated under the previous account.

Confirm that the new account has permission to both the SharePoint site and the specific document/library. The SharePoint connector's Get file content action uses the configured connection to retrieve the file by its identifier.

Also check whether a Conditional Access policy applies to the new user. Microsoft specifically notes that Conditional Access policies, including MFA or device-compliance requirements, can block access through the SharePoint connector.

After updating the connection, save the Logic App and run it again. If it still returns 401, open the failed action's Inputs/Outputs and share the sanitized error body, especially the message and any innerError, as that should distinguish a stale connector token from a SharePoint authorization issue.

Reference:

Microsoft Learn – SharePoint connector: https://learn.microsoft.com/en-us/connectors/sharepointonline/?

Please "Accept the Answer" if this information helped you.

Michael Francis 0 Reputation points

2026-08-13T20:30:52.22+00:00

I reauthenticated the sharepoint api connection and connected my account the sharepoint get file content and I am still getting a 401. How can I make sure that my account has the ability to connect?
Allan Solomon Mejia 8,085 Reputation points

2026-08-13T20:57:11.0933333+00:00

Hi @Michael Francis

Since you've already reauthenticated the SharePoint connection and still receive 401, the next step is to determine whether the failure is coming from the connector authentication or from the specific SharePoint resource being requested.

Please open the failed Get file content action in Run history → Inputs/Outputs and check the 401 response. If possible, share the sanitized message, code, and innerError.

Also verify that the action is actually using the newly reauthenticated connection. In Logic Apps, reauthenticating a connection doesn't necessarily mean every action has been switched to that connection/reference.

As a quick test, using the same connection, add a simple SharePoint action such as Get file metadata or Get files (properties only) against the same site/library. If that also returns 401, it points to the connection/authorization path rather than the file identifier.

If other SharePoint actions work but Get file content fails, then we should check the file identifier and library permissions specifically.

Please "Accept the Answer" if this information helped you.

Michael Francis 0

{

"statusCode": 401,

"headers": {

    "Cache-Control": "private",

    "X-FD-RouteKey": "confidential",

    "X-NetworkStatistics": "41,1048560,55,259269,6318548,78984,78984,2699",

    "X-MSEdge-Ref": "MIRA: 77611261-e5d1-b269-7563-8b4f4c0729c8 IA4P221CA0005 2026-08-13T20:28:58.308Z",

    "X-1DSCollectorUrl": "https://mobile.events.data.microsoft.com/OneCollector/1.0/",

    "IsOCDI": "0",

    "X-NanoProxy": "1",

    "Request-Id": "77611261-e5d1-b269-7563-8b4f4c0729c8",

    "SPRequestGuid": "68c54f36-0f66-49af-9e33-9edf7c9e8e05",

    "X-FD-RouteKeyApplicationEndpointList": "20484-IPV4V6.CLUMP.DPRODMGD105.AA-RT.SHAREPOINT.COM",

    "Content-Security-Policy": "frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com teams.cloud.microsoft *.office365.com goals.cloud.microsoft *.powerapps.com *.powerbi.com *.yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft *.officeapps.live.com *.office.com *.microsoft365.com m365.cloud.microsoft *.cloud.microsoft *.stream.azure-test.net *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com teams.microsoft.com *.teams.microsoft.com securebroker.sharepointonline.com;",

    "MicrosoftSharePointTeamServices": "16.0.0.27605",

    "MS-CV": "ojDv0oRgAOCLEkrFh7qVDA.0",

    "X-FEServer": "IA4P221CA0005",

    "SPIisLatency": "1",

    "SPLogId": "d2ef30a2-6084-e000-8b12-4ac587ba950c",

    "SPRequestDuration": "12",

    "X-AriaCollectorURL": "https://browser.pipe.aria.microsoft.com/Collector/3.0/",

    "X-DataBoundary": "NONE",

    "X-BackEndHttpStatus": "401",

    "X-Content-Type-Options": "nosniff",

    "X-Frame-Options": "SAMEORIGIN",

    "X-MS-InvokeApp": "1; RequireReadOnly",

    "X-Proxy-BackendServerStatus": "401",

    "X-Proxy-RoutingCorrectness": "1",

    "X-FirstHopCafeEFZ": "MNZ",

    "Alt-Svc": "h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000",

    "Strict-Transport-Security": "max-age=31536000; includeSubDomains",

    "P3P": "CP=\"ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI\"",

    "x-ms-subscription-id": "84DA362D-E90F-4810-8A74-E98064719C69",

    "x-ms-dlp-re": "-|-|-",

    "x-ms-dlp-gu": "-|-",

    "x-ms-dlp-ef": "-|-/-|-|-|-|-",

    "x-ms-mip-sl": "-|-|-|-",

    "x-ms-au-caller-id": "b2d75074-5eef-43ac-864b-2719daf51175",

    "x-ms-au-creator-id": "7e6b5079-9c69-4553-b9f7-d47b72ee5313",

    "Timing-Allow-Origin": "*",

    "x-ms-apihub-cached-response": "false",

    "x-ms-apihub-obo": "false",

    "WWW-Authenticate": "Bearer realm=\"subscription-id\",client_id=\"00000003-0000-0ff1-ce00-000000000000\",trusted_issuers=\"00000001-0000-0000-c000-000000000000@*,confidential@*,https://sts.windows.net/*/,https://login.microsoftonline.com/*/v2.0,00000003-0000-0ff1-ce00-000000000000@90140122-8516-11e1-8eff-49304924019b\",authorization_uri=\"https://login.microsoftonline.com/common/oauth2/authorize\"",

    "Date": "Thu, 13 Aug 2026 20:28:57 GMT",

    "Content-Length": "2",

    "Content-Type": "application/json"

},

"body": {}

}

Allan Solomon Mejia 8,085 Reputation points

2026-08-13T22:00:40.1+00:00
Hi @Michael Francis

Thanks for providing the 401 response. This helps narrow it down.

The response shows the request is reaching the SharePoint connector, but authentication isn't being accepted for the operation. Since you've already reauthenticated the connection, I'd focus on the connection reference and the identity actually being used by the Logic App rather than simply reauthenticating again.

Please check the following:

Open the Logic App's API Connections and verify the SharePoint connection shows Connected under the new account.

Edit Get file content and confirm it is referencing that exact connection.

Verify the new account can manually open the same SharePoint site, document library, and file.

Remove and recreate the SharePoint connection if necessary, then explicitly bind the action to the newly created connection.

Check the user's Microsoft Entra sign-in logs at the timestamp of the failed request. This can reveal Conditional Access, token, or authentication failures that aren't visible in the Logic App's 401 response.

One detail in the response is particularly useful: the connector request is going through sharepointonline, so this doesn't look like a malformed destination URL alone. The next thing I'd want to see is the Body of the failed action's Outputs, not just the response headers. SharePoint will often return a more specific error such as AccessDenied, an authentication/token error, or a resource authorization failure there.

If you can share the sanitized Body section of that 401 response, we should be able to narrow this down further.

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.