Netskope LogoNetskope Logo
  • Security Services
  • AI Services
  • Networking Services
  • Analytics Services
  • Integrations
  • getting-started.svgGetting Started
    • Support
    • Community
    • Netskope.com
    © 2026 All Rights Reserved. Netskope Inc.
    Home
    Classic API Data Protection
    API Data Protection for Microsoft Office 365 SharePoint
    Additional Reading
    Grant Failure on Newly Created App Instance

    Grant Failure on Newly Created App Instance

    If you are setting up the Microsoft Office 365 OneDrive or SharePoint instance for the first time on a new Microsoft Office 365 account, the grant may fail. Microsoft has recently disabled apps using an Azure Access Control (ACS) app-only access token by default. If so, follow the steps below to grant access successfully.

    You can change the behavior by running set-SPOTenant -DisableCustomAppAuthentication $false (needs the latest SharePoint admin PowerShell). To do so, follow the steps below:

    Note

    The following steps are performed on a Windows device.

    1. Install the latest version of PowerShell on Windows. Follow the instructions here.
    2. Start PowerShell as an administrator on the Windows device, and run the following commands:
      1. Install-Module -Name Microsoft.Online.Sharepoint.PowerShell
      2. Import-Module Microsoft.Online.Sharepoint.PowerShell
      3. $adminUPN=“<the full email address of the global administrator account, example: admin@sumoskope.onmicrosoft.com>”

        Note

        Fill in the value for the $adminUPN variable (replacing all the text between the quotes, including the < and > characters).

      4. $orgName=“<name of your Office 365 organization, example: sumoskope>”

        Note

        Fill in the value for the $orgName variable (replacing all the text between the quotes, including the < and > characters).

      5. $userCredential = Get-Credential -UserName $adminUPN -Message “<type the password>”

        Note

        When prompted with the Windows PowerShell credential request dialog box, type the password for the global administrator account.

      6. To check the value of DisableCustomAppAuthentication, run the following commands:
        1. Connect-SPOService -Url https://$orgName-admin.sharepoint.com

          Note

          If you get an error message, run the command in step 2b followed by the -UseWindowsPowerShell parameter i.e., Import-Module Microsoft.Online.Sharepoint.PowerShell -UseWindowsPowerShell. And then run the Connect-SPOService -Url https://$orgName-admin.sharepoint.com command.

        2. get-SPOTenant

          Look for the DisableCustomAppAuthentication parameter. It should be set to True.

          Note

          If you do not see the DisableCustomAppAuthentication parameter, execute the Install-Module -Name Microsoft.Online.Sharepoint.PowerShell -Force command and follow the steps from 2b.

      7. Run the following command to set the DisableCustomAppAuthentication value to false:
        1. set-SPOTenant -DisableCustomAppAuthentication $false
      8. Verify that the parameter is set to false. To do so, run the following command:
        • get-SPOTenant

          Look for the DisableCustomAppAuthentication parameter. It should be set to False.

      Once you have set the value of DisableCustomAppAuthentication to false, go back to the Netskope UI and grant access.

    In this Topic
    • Grant Failure on Newly Created App Instance