Used this agent to

Thanks for the additional information.

One thing that stands out from the screenshot is that the SharePoint permissions shown are Delegated permissions (AllSites.Read and AllSites.FullControl). Since you're using with_client_certificate(...), you're using the app-only / client credential flow, which requires Application permissions rather than Delegated permissions. Microsoft's App-Only guidance also describes using SharePoint application permissions for certificate-based authentication.

In your Entra app registration, it should look something like this:

Hi @Edward

Are you accessing SharePoint REST via ClientContext or are you using the library's Microsoft Graph capabilities?

The document you provided supports both SharePoint and Graph APIs, and a 401 can occur if the app permissions and token audience do not match the endpoint being called. For example, a token issued for Microsoft Graph will not be accepted by SharePoint REST endpoints, and vice versa

If you are trying to call SharePoint REST API, you can check the following things:

1. Verify the access token is being issued correctly

If you're using the certificate-based client credential flow, ensure the token is requested for SharePoint and not Microsoft Graph: scopes = ["https://<tenant>.sharepoint.com/.default"]

After obtaining the token, decode it using https://jwt.ms and verify

"aud": "https://<tenant>.sharepoint.com".

"roles": "Sites.FullControl.All"

2. Confirm admin consent was granted in Entra ID, navigate to App Registration > API Permissions > Make sure the API permission status is "Granted for <tenant>"
3. Verify you're using SharePoint permissions, double-check whether the permission was added under SharePoint or Microsoft Graph. It should be SharePoint.

I look forward for your response.