Budibase/budibase · error · HTTPError

Authentication failed with Microsoft Graph. Verify SharePoin

Error message

Authentication failed with Microsoft Graph. Verify SharePoint application credentials and try again.

What it means

fetchSitesPage calls the Microsoft Graph /sites endpoint with a bearer token. A 401 response means the access token was rejected — expired, wrong tenant/audience, or issued from bad client credentials. The code translates this into a 401 HTTPError with an explicit message telling the user to verify the SharePoint application credentials.

Source

Thrown at packages/server/src/sdk/workspace/ai/knowledgeSources/sharepoint/connection.ts:243

      try {
        const payload = (await response.json()) as {
          error?: { code?: string; message?: string }
        }
        errorCode = payload?.error?.code || ""
        errorDescription = payload?.error?.message || ""
      } catch {
        // noop
      }
      console.error("Failed to fetch SharePoint sites (app token)", {
        status: response.status,
        errorCode,
        hasErrorDescription: !!errorDescription,
      })
      let errorMessage = `Failed to fetch SharePoint sites (${response.status})`
      if (response.status === 401) {
        errorMessage =
          "Authentication failed with Microsoft Graph. Verify SharePoint application credentials and try again."
        throw new HTTPError(errorMessage, 401)
      } else if (response.status === 403) {
        errorMessage =
          "Access denied by Microsoft Graph. Ensure SharePoint application permissions are granted."
      } else if (response.status === 400 && errorDescription) {
        errorMessage = `Microsoft Graph rejected the SharePoint search request: ${errorDescription}`
      }
      throw new HTTPError(errorMessage, 400)
    }
    return (await response.json()) as {
      value?: Array<{
        id?: string
        displayName?: string
        name?: string
        webUrl?: string
      }>
      "@odata.nextLink"?: string
    }
  }

View on GitHub (pinned to a81a902e9a)

Solutions

1. Verify the client ID and client secret in the datasource's OAuth2 auth config are current and correct.
2. Confirm the Entra app registration is in the same tenant as the SharePoint sites, and the token audience/scope is correct.
3. Clear the cached OAuth2 token so a fresh one is fetched on the next request.
4. Check server clock sync if tokens appear to expire instantly.

const token = await getSharePointBearerToken(datasourceId, authConfigId)
if (!token) {
  throw new Error("No bearer token available; check SharePoint app credentials first")
}

try {
  await fetchSharePointSitesByDatasourceAuthConfig(datasourceId, authConfigId)
} catch (err) {
  if (err instanceof HTTPError && err.status === 401) {
    // invalidate cached token, re-check client id/secret, then retry once
  }
  throw err
}

When it happens

Trigger: Graph returns HTTP 401 on the sites search request: expired/revoked bearer token, wrong clientSecret, token issued for the wrong tenant or audience, or clock skew in token caching.

Common situations: Rotated client secret not updated in the datasource config; Entra app registered in a different tenant than the sites being queried; cached OAuth2 token invalidated server-side; system clock drift causing premature token expiry.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Error getting account by email ${email}
• Error getting account by tenantId ${tenantId}
• Error getting status
• OIDC Config contents invalid
• Could not refresh OAuth Token

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/16ee9c2967ceabbd. Report an issue: GitHub.