Sharepoint Online Scan: 401 not authorized in ARM

Even after setting the AppID permissions correctly in Sharepoint Online according to this article, the error 'System.Net.WebException: The remote server returned an error: (401) Unauthorized.' will be seen in logs when starting the related scan from ARM, or when attempting to select the SharePoint Elements in the SharePoint Online scan configuration.

Please execute the following command in Powershell after being connected to the Sharepoint Online. To connect to Sharepoint Online you can use the PnP Powershell command as described in this article.

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

1. Open an Administrator-level PowerShell window
2. run Connect-SPOService -Url <your sharepoint admin site URL>
3. This will prompt for a login: use your sharepoint global admin login credentials
4. Run Set-SPOTenant -DisableCustomAppAuthentication $false
5. If no error, then go back to ARM and try to select SharePoint Elements

Example:

If you get an error like No connection available. Change the PowerShell version from 7 to 5 (ask your SharePoint admin). The link to the Microsoft forum where the above recommendation was taken can be found below.

• https://learn.microsoft.com/en-us/answers/questions/90187/sharepoint-app-only-add-ins-throwing-401-unauthori?page=1#answers

If the above does not help, check if there is any conditional access rule preventing the action. You may investigate this in Azure as follows.

1. Sign in to the Azure portal using the Security Reader or Global Admin role.
2. In the Monitoring section, select Sign-in logs.
3. Select a sign-in item from the table to open the Activity Details: Sign-ins context pane.
4. Select the Conditional Access tab.

If the same AppID is being used for scanning both SharePoint Online and Entra ID, we recommend using a dedicated AppID for SharePoint Online. In addition, make sure the Client Secret Value is still valid.