title: Authentication to Sharepoint Online with CSOM
body: <p>I feel like I'm missing something here.  I'm trying to login to a SPO tenant via a C# Console app, but I'm getting the error:</p>
  
  <blockquote>
    <p>Cannot contact web site '<a href="https://xxx.sharepoint.com/" rel="nofollow noreferrer">https://xxx.sharepoint.com/</a>' or the web site does not support SharePoint Online credentials. The response status code is 'Unauthorized'.</p>
  </blockquote>
  
  <p>I know the account works, as I'm able to login with the account directly from browsers.  In the end, I'd <em>like</em> to use the CSOM to do CRUD operations on SP Lists, Term Stores and Document Libraries, but CSOM is not a hard requirement (and I admittedly don't know if REST APIs can do the whole job).</p>
  
  <p>I've seen that changing the <code>LegacyAuthProtocolsEnabled</code> value to True can help with this, but our security folks won't allow me to enable that feature.  </p>
  
  <p>The code is pretty vanilla:</p>
  
  <pre><code>SecureString passWord = getPassword();
  using (var context = new ClientContext(URI))
  {
      context.Credentials = new SharePointOnlineCredentials(userName, passWord);//new NetworkCredential(userName, passWord);//
      context.Load(context.Web, web =&gt; web.Title);
      context.ExecuteQuery(); //Error happens here
      Console.WriteLine("Your site title is: " + context.Web.Title);
  }
  </code></pre>
  
  <p>As you can see, I've also tried passing the <code>NetworkCredentials</code> object, which also doesn't work (I also get a 401 response).  </p>
  
  <p>As a further note, I've looked into App-only identities, but I don't believe I can use those due to their restrictions on managing taxonomy (ie. managed metadata within Term Stores) and managing files (though this may be a restriction only on using CSOM, it's not clear to me from <a href="https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly" rel="nofollow noreferrer">this page</a>)</p>
  
  <p>Based on this, can you see what I'm doing wrong here?  Or if there's a different/better way to do this, I'm open to that as well!  </p>
  
  <p><strong>EDIT</strong>:  Looks like when <code>LegacyAuthProtocolsEnabled</code> is set to False I explicitly cannot use the <code>SharePointOnlineCredentials</code> class at all, based on <a href="https://docs.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenant?view=sharepoint-ps" rel="nofollow noreferrer">this page</a>.  Given that, looks like I need a different approach to get this access!</p>