Fix new bug with querying SharePoint documents using AppOnly token
It appears that some change has been rolled out to certain SharePoint Online tenancies that has broken the ability to query documents using an AppOnly access token. This happens for both CSOM and REST queries.
Queries that were working fine a week ago suddenly started failing, with the error:
> "The label that's applied to this item prevents it from being edited or deleted. Check the item's label for more details."
This error makes no sense because:
1. There are no labels applied to the documents I am trying to query, and
2. I'm not even trying to edit the items, just query them
This seems to be only affecting certain tenancies at the moment, but it is affecting all apps that try to query from the affected tenancies (including a simple console app I made to troubleshoot the issue), and affects all files of certain types (Word, Excel, CSV, InfoPath XML, probably others) in all libraries of the affected tenancies.
Based on the below post on Stack Overflow, it looks like at least five other app developers aside from myself are seeing this problem. All of them report the same thing - that their apps were able to query documents fine until a week ago:
It also looks like a Microsoft employee has also been able to reproduce the issue and suggested that I make a post here:
Is anyone on the dev team paying attention to this issue or working to fix it? I opened an Office 365 support ticket, but was first told that it was an app-specific problem, and when I thoroughly demonstrated that it wasn't an app specific problem, I was told that there was nothing they could do to fix what is very clearly a breaking change.
The issue is resolved with recreating (revert to full access and then adjust what you need) SharePoint Online Access Policies for Azure Active Directory - Conditional Access.
Error message is wrong and it does not have nothing with labels on https://protection.office.com