Microsoft.InformationProtection.Exceptions.AccessDeniedException: The service didn't accept the auth token

Question

I want to extend an existing migration tool to set sensitivity labels on files before they get imported into Sharepoint Online. I have found the Microsoft Information Protection SDK, which seems to provide the necessary API.

To get familiar with the API, I downloaded and ran the ServicePrincipalAuth example application (see https://learn.microsoft.com/en-us/samples/azure-samples/mipsdk-dotnet-file-serviceprincipalauth/mipsdk-dotnet-file-serviceprincipalauth/). But although I have followed the steps exactly, I always get an AccessDeniedException with message "The service didn't accept the auth token" in the CreateFileEngine method at the line

var engine = Task.Run(async () => await profile.AddEngineAsync(engineSettings)).Result;

I have tried both authentication variants (certificate and secret key) so far. Same result for both.

My App.config file looks like this:

<configuration>
  <startup> 
    <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.7.2"/>
  </startup>
  <appSettings>
    <add key="ida:ClientId" value="[client ID from Azure AD app]"/>    
    <add key="ida:RedirectUri" value="mipsdk-auth-sample://authorize2"/>
    <add key="ida:CertThumbprint" value="[thumbprint of my self-signed certificate]"/>
    <add key="ida:ClientSecret" value="[client secret from Azure AD app]"/>
    <add key="ida:DoCertAuth" value="true"/>        
    <add key="ida:Tenant" value="[my tenant name].onmicrosoft.com"/>        
    <add key="app:Name" value="mipsdk-auth-sample2"/>
    <add key="app:Version" value="1.0.0"/>    
  </appSettings> 
</configuration>

UPDATE:

Our administrator needed to consent to the API permissions requested by the Azure AD app. After this was done, the authentication worked as expected!

Unfortunately, I ran into a new error:

RMS service is disabled for publishing for this user., CorrelationId=e2e..., CorrelationId.Description=FileHandler, HttpRequest.Id=00d..., ServiceDisabledError.Extent=User

This time in the SetLabel method at the line:

var result = Task.Run(async () => await handler.CommitAsync(options.OutputName)).Result;

The error message suggests to enable the RMS service for the user. How can I (or our administrator) do this for the Azure AD app?

Any hint is greatly appreciated!

Answer 1

The error you're seeing is because onboarding control policies are enabled in the RMS service.

https://learn.microsoft.com/en-us/powershell/module/aadrm/set-aadrmonboardingcontrolpolicy?view=azureipps

You'd need to follow up with you administrator to ask them how they've configured the policy. If they've set a group, you'll need to add the service principal to an AAD group that is enabled as part of the onboarding controls.