Request to Sharepoint sign-in endpoint ?wa=wsignin1.0 returns 403

Question

Request to Sharepoint sign-in endpoint ?wa=wsignin1.0 returns 403

Paul Graham1 150

SAML authentication flow for our ERP integration with SharePoint stopped working for multiple customers.

In the final step of the authentication, the POST request is sent with the BinarySecurityToken in the body to the address below. Instead of returning the FedAuth authentication cookie, it responds with the HTTP code 403 - Forbidden.

https://[YourDomain].sharepoint.com/_forms/default.aspx?wa=wsignin1.0

To clarify: This is not a new development or new installation. This is something that has been working for a long time and for many customers, and recently, it stopped.

0 comments

8 answers

Your answer

Answer 1

Adi Roiban 25

We are not talking about Basic Authentication

This is SAML Claims-Based authentication with the Federation Authentication (FedAuth) cookie

With the user based authentication model, we get fine grained permissions for SharePoint Files

With OAuth2 Application ID, you only have generic site-level permisisons.

0 comments

Answer 2

rob.h 10

LegacyAuthProtocolsEnabled is not sufficient. You need the setting AllowLegacyBrowserAuthProtocolsEnabledSetting. Please note that the spelling in the documentation is incorrect (the prefix “Allow” and the suffix “Setting” are missing in the documentation).

This worked for us:

Set-SPOTenant -AllowLegacyBrowserAuthProtocolsEnabledSetting $true

This may not work after October 15th 2025, see https://cdm.iamcloud.info/docs/Content/RevertChange.htm

Related link: https://mc.merill.net/message/MC1097272

Raúl Ramírez 0 Reputation points

2025-09-16T08:33:11.2433333+00:00

I tried it but still doesn't work for me. I keep getting the 403 error and no cookies. I have those params changed to true:
LegacyAuthProtocolsEnabled : True

LegacyBrowserAuthProtocolsEnabled : True

AllowLegacyBrowserAuthProtocolsEnabledSetting : True EDIT: After 20 minutes, it worked. It seems you have to wait a bit after making those changes, but it finally works.
David VanSickle 5 Reputation points

2025-09-16T11:18:36.91+00:00

You need to open a premier, unified support ticket if you need a temporary extension. I referenced our support case and someone else's in the thread. You will not get past this without reaching out to Microsoft.
SColley 20 Reputation points

2025-09-16T14:00:21.1966667+00:00

Worked immediately on my tenant

Answer 3

Jake Novak 30

Given the length of time this was unavailable, we were forced to update our code to use a different authentication method.

To their credit, Microsoft Support did finally respond to our case number and reversed the change on our tenant (with warnings that it would become unavailable again around October). The former code we had been using for over a decade began working again at that time.

SColley 20 Reputation points

2025-08-21T12:09:53.74+00:00

Hi Jake.

Which authentication method did you go to? Can you point me in the right direction.

My code has only been working for 9 years and now suddenly stopped!

Cheers

Steve
David VanSickle 5 Reputation points

2025-08-21T13:29:01.56+00:00

I hope we can get the same exception! Did you open a Sev A ?
Jake Novak 30 Reputation points

2025-08-21T13:36:12.1966667+00:00

@David - Yes; it was a Sev A ticket, and we had a lot of intervention from our account mgr.

@SColley - Our temporary fix was the least invasive code option, Azure ACS, but that will be turned off in April. Long term we will likely be migrating to Graph.
David VanSickle 5 Reputation points

2025-08-27T21:49:48.13+00:00

@Jake Novak can you please share the Sev A ticket #, if you need to send it to me privately, my email address is ******@fcsamerica.com
David VanSickle 5 Reputation points

2025-08-27T21:50:38.91+00:00

first.lastname Jake, sorry, the forum obfuscated it.
David VanSickle 5 Reputation points

2025-08-29T12:22:44.3933333+00:00

With a significant amount of work, we were finally able to get an extension. "Please be informed that the security enforcement applied to your tenant has been reversed, this is valid until Oct 15th, 2025." The support case number was TrackingID#2508210040005205. Thanks to Jake Novak, the Sev A case you opened made all the difference! Happy Friday all!
Corey White 0 Reputation points

2025-09-08T17:11:27.1366667+00:00

@David VanSickle Looks like our tenant ran into the same issue starting Friday. Did you turn in your ticket through Direct support? I am trying to figure out the quickest way to get our's turned back on.
David VanSickle 5 Reputation points

2025-09-08T17:14:49.81+00:00

We did, but honestly, it was a nightmare. If you have access to a unified support agreement and can open a Sev A, that is the best way. If you do that reference this case number #2508190040009024 and send Jake Novak a big thank you!
Raúl Ramírez 0 Reputation points

2025-09-19T09:01:11.1266667+00:00

@Jake Novak Could you please help me to fix the problem using Azure ACS?

I have a connector using Graph API, but it's very slow due to the API calls being slow and it doesn't let you do a lot of requests in a short time.

If you need to send it to me privately, my email address is ******@driving01.com (without accents).

Thanks in advance.

Answer 4

Paul Graham1 150

thanks for your help.

follow-up:
we have a Legacy enabled in a test environment and still there is no cookie issued in this step:

POST that token to /_forms/default.aspx?wa=wsignin1.0 → expect FedAuth/rtFa cookies

Wiese 25 Reputation points

2025-08-19T14:27:00.4533333+00:00

Same problem here. No cookies returned.
Roger Hu 胡士鑫 10 Reputation points

2025-08-19T15:47:02.32+00:00

same problem...
Jake Novak 30 Reputation points

2025-08-19T17:36:13.2433333+00:00

We are also having this issue.
Slobodan Jovanovic 0 Reputation points

2025-08-20T10:03:57.4433333+00:00

same problem here.
David VanSickle 5 Reputation points

2025-08-22T13:04:15.2966667+00:00

We proactively reached out to Microsoft in July to ask if BasicAuth would be impacted, they indicated that Secure by Default would only apply to tenants not configured with InTune initially. Specifically explained we needed this until October, and were assured our business process would not be impacted. Now we are down, and Microsoft is slow walking our escalations, even though Jake Novak was able to get help through a Sev A, albeit, with difficulty. Our Microsoft account manager has escalated, still waiting.
Aing Sokea 5 Reputation points

2025-08-25T08:40:13.7833333+00:00

I am also facing the same issue. Our production was interrupted on 18th August 2025 due to the sudden disablement of this authentication method. The Microsoft support team should provide a solution as soon as possible or consider rolling it back.
Omar Abdo 0 Reputation points

2025-08-26T13:18:37.7033333+00:00

Same issue here. The response returned is a 403 FORBIDDEN and no cookies. Entra sign-in logs for the user show it as successful.
P Mugunthan 25 Reputation points

2025-09-08T06:16:34.7733333+00:00

Hi , We are facing the same issue from 5th September. Were you able to resolve this?
David VanSickle 5 Reputation points

2025-09-08T16:56:19.6766667+00:00

After a weeklong effort and significant escalation we were able to get an extension (they reversed the security enforcement) until October 15th, do you have a support case open?
McAllister, Paddy 5 Reputation points

2025-09-09T09:56:25.98+00:00

Same issue here from 8th Sept. Raised ticket requesting rollback. These posts where very helpful to identify the issue. thanks all

Answer 5

Anonymous

Hi @Paul Graham1

Thank you for posting your question in the Microsoft Q&A forum.
According to What's deprecated or removed from SharePoint Server Subscription Edition? - SharePoint Server | Microsoft Learn, Basic authentication is deprecated but will remain supported for the SharePoint Server Subscription Edition until July 14, 2026. After that date, Basic authentication will no longer be supported and will eventually be removed in SharePoint Server Subscription Edition for all scenarios.

Additionally, based on my research, SharePoint Online is moving away from the legacy WS-Fed and wsignin1.0 passive SAML authentication method. Instead, it's adopting modern authentication standards like OAuth 2.0 and OpenID Connect, which offer improved security and better integration with current identity platforms.

We appreciate your understanding that sometimes the initial suggestions may not resolve the problem very soon. However, we can work together to narrow down and resolve the situation. To help us move forward, could you please run the following PowerShell commands and share the results?

Connect-SPOService -Url https://<your-tenant-name>-admin.sharepoint.com 
Get-SPOTenant | Select-Object LegacyAuthProtocolsEnabled

If the value is false, you can enable legacy authentication protocols using:

Set-SPOTenant -LegacyAuthProtocolsEnabled $true

You can read more at Set-SPOTenant (Microsoft.Online.SharePoint.PowerShell) | Microsoft Learn
Please let us know what you find, and we’ll be happy to assist further.
Thank you for your patience and cooperation.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Wiese 25 Reputation points

2025-08-19T12:54:40.9266667+00:00

I have a very similar problem that started to show today: When I call https://[YourDomain].sharepoint.com/_forms/default.aspx?wa=wsignin1.0

I receive an empty list of cookies instead of the ones I have received the day before.

Get-SPOTenant returns LegacyAuthProtocolsEnabled = True, so that does not seem to help.

Any idea how to resolve this problem quickly? Our production systems is currently non-usable because of this.
Anonymous

2025-08-19T13:37:11.87+00:00

We have also tried, Get-SPOTenant | Select-Object LegacyAuthProtocolsEnabled command and it returns true. Even then the
Fcco 20 Reputation points

2025-08-19T16:35:03.8233333+00:00

Same issue here, provided solution does not work. Please concider this as an urgent issue.
David VanSickle 5 Reputation points

2025-08-22T13:29:56.2366667+00:00