Sounds like you mean 403 forbidden, not 401 unauthorized (since you say authorized access, not authentication). This source explains it in better detail: Daniel Irvine
401 Unauthorized, the HTTP status code for authentication errors. And that’s just it: it’s for authentication, not authorization. Receiving a 401 response is the server telling you, “you aren’t authenticated–either not authenticated at all or authenticated incorrectly–but please reauthenticate and try again.” To help you out, it will always include a WWW-Authenticate header that describes how to authenticate.
Receiving a 403 response is the server telling you, “I’m sorry. I know who you are–I believe who you say you are–but you just don’t have permission to access this resource. Maybe if you ask the system administrator nicely, you’ll get permission. But please don’t bother me again until your predicament changes.”
I've never heard of a 401/403 status code being bad practice. In non-attack scenarios, it serves the important function of letting a user know that they need to request a privilege upgrade or go to somebody with higher privileges to complete some task. In many of these cases a user needs to know that the resource exists.
It does reveal to attackers that a resource does exist, potentially enlarging the attack surface of your app. However if you're depending on an attacker not knowing about a resource to keep it safe, you should probably improve the defenses around it instead. The usability advantages outweigh the slight security disadvantages.