Connect-PnPOnline Client Secret Authentication Suddenly Failing with "Unauthorized" – Could This Be Related to ACS Retirement?

[nelson5817]

Hi,

We have recently encountered an issue with Connect-PnPOnline when authenticating using Client ID and Client Secret against SharePoint Online.

The connection was previously working, but it now fails with the following error:
Unexpected response from the server. The content type of the response is "". The status code is "Unauthorized".

We have already verified the following:

• The Client ID and Client Secret are correct.
• Required SharePoint permissions (e.g Sites.FullControl.All) are granted and consented.

I would like to seek confirmation whether this could be related to the retirement of Azure ACS (Access Control Services) for SharePoint, it stated fully retired on April 2, 2026.

https://learn.microsoft.com/en-us/sharepoint/dev/sp-add-ins/add-ins-and-azure-acs-retirements-faq

Any guidance would be greatly appreciated.

Thank you.

[stabach]

Yeah, that lines up exactly with the ACS shutdown.

That -ClientId/-ClientSecret combo you're using with Connect-PnPOnline? PnP flags that as the legacy SharePoint ACS app-only auth which basically, the moment you pass in -ClientSecret, routes you through ACS under the hood.

And ACS for SharePoint Online has been dead since early april. So no amount of double-checking your secret or permissions is going to fix that 401. It's not a config issue, the whole auth path just doesn't exist anymore.

For unattended/automated scenarios, you'll want to switch over to Entra ID app-only auth with a certificate instead:
Connect-PnPOnline -Url "https://thesite.sharepoint.com/sites/example"
-ClientId "" -Tenant "thesite.onmicrosoft.com"
-CertificatePath "C:\Certificates\app.pfx"

Just make sure the cert's public key is uploaded to the app registration in Entra, and that the app has the right application permissions with admin consent.

And if this is running inside Azure somewhere like automation, managed identity is worth considering too like we did.

[rakeshranderia]

Yes, this look consistent with ACS retirement.

In PnP PowerShell, using Connect-PnPOnline with -ClientSecret uses the legacy SharePoint ACS authentication flow, even if the Client ID originated from an Entra app registration. PnP currently documents that parameter set as SharePoint ACS (Legacy) App Only.

Azure ACS for SharePoint Online stopped working 2nd April 2026, so previously valid client ID/secret combination will now return "Unauthorized" even though the secret itself and the SharePoint permissions are still valid.

The fix: move the automation to Entra ID app-only authentication rather than trying to repair the ACS configuration. For unattended PnP PowerShell that means certificate-based authentication, eg:

Connect-PnPOnline `
    -Url "https://domain.com/sites/site" `
    -ClientId "<app-id>" `
    -Tenant "domain.onmicrosoft.com" `
    -CertificatePath "c:\locationofcert\app.pfx" `
    -CertificatePassword $certPassword

Grant the SharePoint application permissions to that Entra app and provide admin consent. (limit the app to specific sites, Sites.Selected is also worth considering rather than tenant-wide Sites.FullControl.All.)

The above presumes a migration effort rather than troubleshooting the existing setup.