I found myself encountering the following error when authenticating to SharePoint Online using CSOM from PowerShell:
Exception calling “ExecuteQuery” with “0” argument(s): “For security reasons DTD is prohibited in this XML document. To enable DTD processing set the DtdProcessing property on XmlReaderSettings to Parse and pass the settings into XmlReader.Create method.”
I believe that there a number of causes for this issue some of which are firewall and ISP related. This may only resolve a subset of the cases where this issue has been arising, even under the same circumstances.
In my scenario, I found that this issue was only arising when the credentials I was passing were being federated. That is, when the username was *not* in form <me>@<domain>.onmicrosoft.com but rather something like <me>@<domain>.co.uk. It is also possible that this issue resolves itself after a single successful authentication has occurred. Try providing credentials for a *.onmicrosoft.com account, and if that works try again with a federated account. This is discussed more later.
I used Fiddler to compare the request/response trace from a successful authentication and one where this error occurs. It turns out that somewhere internally a request is made to msoid.<full-domain> where <full-domain> is the bit after the @ symbol from the username provided. In the case where this value is of the *.onmicrosoft.com variety, a 502 error (no DNS entry) is returned with no request body and the authentication proceeds successfully. In the other case, the ‘msoid’ URL is resolved and a response with a request body is returned.
In my case the response was a 301 error (permanent relocation), however I read of cases where a 200 (success) has been received. Importantly to note, is that the response, success or otherwise, returns an HTML body containing a DTD (Document Type Declaration), and in turn produces the rather unhelpful error message.
So how do you fix it? Well one way is to provide an entry in your hosts file which ensure that the msoid URL will be invalid. I found that providing a local host entry for it worked. Your hosts file can be found here:
C:\Windows\System32\drivers\etc
I added a line which looks like the following:
127.0.0.1 msoid.<domain>.co.uk
And it worked! Intriguingly I found that if I then removed this line from my hosts file, SharePoint Online authentication from PowerShell continued to work. It is for this reason that I suggested trying to use a *.onmicrosoft.com account first at the begging of this post – just in case it resolves the issue for you without touching the hosts file. Please comment if you have any success (or otherwise) with that approach.
Hope this helps! Good luck.
ran into this today while writing console apps on my desktop to connect to my O365 site.
I also opened up fiddler to see what the problem was after reading Technet and other posts blame the ISP. I saw verizon search assist. The key is to disable this search assist or whatever your ISP is doing with the DNS.
I’m in the US and Verizon FIOS had instructions to do this on their website. After that reboot and it was working.
I tried the host file method and that was not working for me. My username is also a @.onmicrosoft.com – and I was using standard site collection on O365.
Thanks for your work, if definitely helped me figure out my specific issue!
Sounds like you had a slightly different issue, but glad I could help somewhat! Thanks for your comments, hopefully others with your exact issue will come across this 🙂
This article is really helpful, although adding records in hosts file didn’t resolve my problem.
I end up setting a different DNS in DHCP server.
I had a similar issue the first day I was working from home.
Apparently it’s something to do with a page not found being returned, change your dns to 8888 8844 / opendns and it should fix the issue.
I was getting “Error Exporting User Profile Properties! Exception calling “ExecuteQuery” with “0” argument(s): “For security reasons DTD is prohibited in this XML document. To enable DTD processing
set the DtdProcessing property on XmlReaderSettings to Parse and pass the settings into XmlReader.Create method.” when exporting user profile data. Changing my dns to 8888/8844 worked for me.
Thanks!