Request to Sharepoint sign-in endpoint ?wa=wsignin1.0 returns 403

Paul Graham1 150 Reputation points
2025-08-19T00:36:17.4466667+00:00

SAML authentication flow for our ERP integration with SharePoint stopped working for multiple customers.

In the final step of the authentication, the POST request is sent with the BinarySecurityToken in the body to the address below. Instead of returning the FedAuth authentication cookie, it responds with the HTTP code 403 - Forbidden.

https://[YourDomain].sharepoint.com/_forms/default.aspx?wa=wsignin1.0

To clarify: This is not a new development or new installation. This is something that has been working for a long time and for many customers, and recently, it stopped.

Microsoft 365 and Office | SharePoint | Development
0 comments

8 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Jason Mott 0 Reputation points
    2025-08-19T19:47:17.8066667+00:00

    Looks like it is due to this:

    https://mc.merill.net/message/MC1097272

    Microsoft have completed the work on disabling legacy authentication. They were projecting to complete in August 2025.

    Was this answer helpful?

  2. Paul Graham1 150 Reputation points
    2025-08-19T13:30:04.6033333+00:00

    thanks for your help.

    follow-up:
    we have a Legacy enabled in a test environment and still there is no cookie issued in this step:

    POST that token to /_forms/default.aspx?wa=wsignin1.0 → expect FedAuth/rtFa cookies

    Was this answer helpful?

    2 people found this answer helpful.
  3. Anonymous
    2025-08-19T07:52:15.6466667+00:00

    Hi @Paul Graham1 

    Thank you for posting your question in the Microsoft Q&A forum. 
    According to What's deprecated or removed from SharePoint Server Subscription Edition? - SharePoint Server | Microsoft Learn, Basic authentication is deprecated but will remain supported for the SharePoint Server Subscription Edition until July 14, 2026. After that date, Basic authentication will no longer be supported and will eventually be removed in SharePoint Server Subscription Edition for all scenarios. 

    Additionally, based on my research, SharePoint Online is moving away from the legacy WS-Fed and wsignin1.0 passive SAML authentication method. Instead, it's adopting modern authentication standards like OAuth 2.0 and OpenID Connect, which offer improved security and better integration with current identity platforms.  

    We appreciate your understanding that sometimes the initial suggestions may not resolve the problem very soon. However, we can work together to narrow down and resolve the situation. To help us move forward, could you please run the following PowerShell commands and share the results?  

    Connect-SPOService -Url https://<your-tenant-name>-admin.sharepoint.com 
Get-SPOTenant | Select-Object LegacyAuthProtocolsEnabled 

    If the value is false, you can enable legacy authentication protocols using: 

    Set-SPOTenant -LegacyAuthProtocolsEnabled $true 

    You can read more at Set-SPOTenant (Microsoft.Online.SharePoint.PowerShell) | Microsoft Learn
    Please let us know what you find, and we’ll be happy to assist further. 
    Thank you for your patience and cooperation. 

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.