Azure Function(C#)：使用CSOM认证SharePoint Online的最优方案咨询

一、前置准备：注册Azure AD应用并配置权限 #

• 在Azure AD中注册单租户类型的新应用程序
• 生成客户端密码（密钥），记录客户端ID、客户端密钥、租户ID三个核心参数
• 配置SharePoint应用权限：
  1. 进入应用的「API权限」页面，添加权限 -> 选择「SharePoint」->「应用权限」
  2. 根据业务需求选择对应权限（如仅需读写站点选Sites.ReadWrite.All，全站点控制选Sites.FullControl.All）
  3. 点击「授予管理员同意」完成权限生效

二、Azure Function配置：存储敏感信息 #

将以下参数添加到Azure Function的应用设置中（禁止硬编码到代码）：

• AZURE_AD_CLIENT_ID：Azure AD应用的客户端ID
• AZURE_AD_CLIENT_SECRET：生成的客户端密钥
• TENANT_ID：租户ID
• SHAREPOINT_SITE_URL：目标SharePoint站点的完整URL（如https://contoso.sharepoint.com/sites/MyBusinessSite）

三、安装依赖NuGet包 #

在Function项目中安装两个核心包：

Install-Package Microsoft.SharePointOnline.CSOM
Install-Package Microsoft.Identity.Client

四、CSOM认证与文件操作实现 #

1. 获取SharePoint访问令牌 #

using Microsoft.Identity.Client;
using System;
using System.Threading.Tasks;

public static async Task<string> GetSharePointAccessToken()
{
    var clientId = Environment.GetEnvironmentVariable("AZURE_AD_CLIENT_ID");
    var clientSecret = Environment.GetEnvironmentVariable("AZURE_AD_CLIENT_SECRET");
    var tenantId = Environment.GetEnvironmentVariable("TENANT_ID");
    var siteUrl = Environment.GetEnvironmentVariable("SHAREPOINT_SITE_URL");

    var authority = $"https://login.microsoftonline.com/{tenantId}";
    var scopes = new[] { $"{new Uri(siteUrl).GetLeftPart(UriPartial.Authority)}/.default" };

    var app = ConfidentialClientApplicationBuilder
        .Create(clientId)
        .WithClientSecret(clientSecret)
        .WithAuthority(new Uri(authority))
        .Build();

    var result = await app.AcquireTokenForClient(scopes).ExecuteAsync();
    return result.AccessToken;
}

2. 文件上传实现 #

using Microsoft.SharePoint.Client;
using System.IO;
using System.Threading.Tasks;

public static async Task UploadFileToSP(string localFilePath, string targetLibraryName, string fileName)
{
    var siteUrl = Environment.GetEnvironmentVariable("SHAREPOINT_SITE_URL");
    var accessToken = await GetSharePointAccessToken();

    using (var context = new ClientContext(siteUrl))
    {
        context.ExecutingWebRequest += (sender, e) =>
        {
            e.WebRequestExecutor.RequestHeaders["Authorization"] = $"Bearer {accessToken}";
        };

        var targetLib = context.Web.Lists.GetByTitle(targetLibraryName);
        context.Load(targetLib.RootFolder);
        await context.ExecuteQueryAsync();

        var fileBytes = File.ReadAllBytes(localFilePath);
        var fileInfo = new FileCreationInformation
        {
            Content = fileBytes,
            Url = fileName,
            Overwrite = true
        };

        targetLib.RootFolder.Files.Add(fileInfo);
        await context.ExecuteQueryAsync();
    }
}

3. 文件下载实现 #

using Microsoft.SharePoint.Client;
using System.IO;
using System.Threading.Tasks;

public static async Task<byte[]> DownloadFileFromSP(string targetLibraryName, string fileName)
{
    var siteUrl = Environment.GetEnvironmentVariable("SHAREPOINT_SITE_URL");
    var accessToken = await GetSharePointAccessToken();

    using (var context = new ClientContext(siteUrl))
    {
        context.ExecutingWebRequest += (sender, e) =>
        {
            e.WebRequestExecutor.RequestHeaders["Authorization"] = $"Bearer {accessToken}";
        };

        var targetLib = context.Web.Lists.GetByTitle(targetLibraryName);
        var file = targetLib.RootFolder.Files.GetByUrl(fileName);
        var fileStream = File.OpenBinaryDirect(context, file.ServerRelativeUrl);

        using (var ms = new MemoryStream())
        {
            await fileStream.Stream.CopyToAsync(ms);
            return ms.ToArray();
        }
    }
}

五、核心优化与注意事项 #

• 权限最小化：避免过度授权，仅分配业务必需的权限（如仅操作特定文档库可申请Sites.Selected权限并绑定目标站点）
• Token缓存：可引入MemoryCache缓存已获取的令牌，减少Azure AD请求次数，提升Function执行效率
• 异常处理：添加网络超时、Token过期、权限不足等场景的捕获逻辑，确保服务稳定性
• 版本兼容：始终使用最新版CSOM包，适配SharePoint Online的最新特性与安全补丁

内容的提问来源于stack exchange，提问作者Marko Rakic