I have one environment with CRM Online and Sharepoint Online. My account to login is a Office 365 account.

In CRM I have registered a Plugin that should create a sharepoint document location and the appropriate folder in sharepoint,
when creating a new instance of my custom entity. (I do it myself, because I don't like it, that the folder gets the objects name)

Now the problem is the following:
In my opinion I need a SAML Token to authenciate at Sharepoint Online.
But to get the SAML Token I need the Microsoft.Identity.dll.
That works fine as long my plugin does not have to run in sandbox mode.
But in CRM Online my plugin has to run in sandbox mode -
and then I get the following exception, when calling the first method from Microsoft.Identity.dll:
That assembly does not allow partially trusted callers.

Is there any possibility to get the SAML Token without the Microsoft.Identity.dll?

I have already tried to add the following line to my assemblies:
[assembly: AllowPartiallyTrustedCallers]
The result is the same.

(I really need the SAML token because if I don't retrieve a SAML Token I get a "Forbidden" error message when trying to call the Sharepoint Listservice)

I would be really glad if you could help me!

I have also already opened a incident at the Microsoft Support
(Service Id: 113020710199630)