Thanks to @nielsgerrits​ I was able to get to connect by updating the request format to include the client secret. So it now looks like:

client_id=_CLIENT_ID]&client_secret=rCLIENT_SECRET]&refresh_token=kREFRESH_TOKEN]&grant_type=refresh_token

and this works. Much thanks!!

Thanks for the feedback. I just checked how my working sharepoint connection was configured which was created in a FME 2019 version. I removed my original answer because in the article How to create a Sharepoint Web Connection because the next piece is stated:

Note: This will not work in earlier versions of FME because the Client Secret has to have a value. In FME 2020+ this can be optional. Azure says that clients that cannot be trusted to keep a secret, such a desktop apps, are called Public Clients (which FME is). Apps that identify as a Public Client must never send a Client Secret, or else the server will reject it.

So while this works, I doubt this is the correct way. You probably want to check with someone from Safe if your implementation is correct.

Thanks for the feedback. I saw that as well, so expected the server would reject it if it was incorrect. However, it's rejecting my connection without it and only accepting it with it. I'll try and reach out to Safe directly. Appreciate the help!

Hi jjuker, having a very similar issue here, except that it seems that you got one step further, since in my case I receive the error message: Unable to retrieve access token - Request to update access token failed. HTTP error: HTTP/ 1.1 401 Unauthorized.

Hi, @joris_frenkel​ ​  Did you solve your connection issue? If yes - how?

Hi @peteralstorp​  I just managed to solve this problem. At last, what @jjuker​ wrote about the client secret helped me solve it. When I made a new Web Connection WITH a secret, it worked, while without a secret it doesn't, just as @jjuker​ noted.

This is for a Sharepoint List reader/writer.

For a Sharepoint OnlineConnector you do not need a secret.

Thank you so much for your answer, @joris_frenkel​ I will try this asap!

@joris_frenkel​ My colleague asked me to trouble you for a printscreen or similar of your connection settings. Could you pls post this here - or send it via e-mail to peter.alstorp@tyrens.se if you rather keep it private?

Hi, I want to add that I now managed to make a correct connection without a secret. It works better that way. It worked with a secret, but then my Redirect URI was incorrect. Now that I corrected the Redirect URI, it works without the secret (and it works better, since I don't need to authenticate every time).

Hi, I want to comment that there seems to be an error in the mentioned article. In the last paragraph, Connecting to Sharepoint with your own Client ID Single Tenant], it tells you that in the Redirect URI 'common' should be replaced with the tenant-id. It should not, at least in our situation. 'Common' should only be replaced in the Authorization URL and the Retrieve Token URL (and should be replaced automatically in the Refresh Token URL).

Further, take note that the prompt at the end of the authorization URL can influence the behaviour of the connection. If it says prompt=consent, it will ask for consent from an Azure administrator every time you try to authenticate. This may be ok for a new user, but otherwise it may not work as needed. It may be better to change it to prompt=select_account