Request to Sharepoint sign-in endpoint ?wa=wsignin1.0 returns 403

Paul Graham1 150 Reputation points
2025-08-19T00:36:17.4466667+00:00

SAML authentication flow for our ERP integration with SharePoint stopped working for multiple customers.

In the final step of the authentication, the POST request is sent with the BinarySecurityToken in the body to the address below. Instead of returning the FedAuth authentication cookie, it responds with the HTTP code 403 - Forbidden.

https://[YourDomain].sharepoint.com/_forms/default.aspx?wa=wsignin1.0

To clarify: This is not a new development or new installation. This is something that has been working for a long time and for many customers, and recently, it stopped.

Microsoft 365 and Office | SharePoint | Development
0 comments

8 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2025-08-19T07:52:15.6466667+00:00

    Hi @Paul Graham1 

    Thank you for posting your question in the Microsoft Q&A forum. 
    According to What's deprecated or removed from SharePoint Server Subscription Edition? - SharePoint Server | Microsoft Learn, Basic authentication is deprecated but will remain supported for the SharePoint Server Subscription Edition until July 14, 2026. After that date, Basic authentication will no longer be supported and will eventually be removed in SharePoint Server Subscription Edition for all scenarios. 

    Additionally, based on my research, SharePoint Online is moving away from the legacy WS-Fed and wsignin1.0 passive SAML authentication method. Instead, it's adopting modern authentication standards like OAuth 2.0 and OpenID Connect, which offer improved security and better integration with current identity platforms.  

    We appreciate your understanding that sometimes the initial suggestions may not resolve the problem very soon. However, we can work together to narrow down and resolve the situation. To help us move forward, could you please run the following PowerShell commands and share the results?  

    Connect-SPOService -Url https://<your-tenant-name>-admin.sharepoint.com 
Get-SPOTenant | Select-Object LegacyAuthProtocolsEnabled 

    If the value is false, you can enable legacy authentication protocols using: 

    Set-SPOTenant -LegacyAuthProtocolsEnabled $true 

    You can read more at Set-SPOTenant (Microsoft.Online.SharePoint.PowerShell) | Microsoft Learn
    Please let us know what you find, and we’ll be happy to assist further. 
    Thank you for your patience and cooperation. 

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

    Was this answer helpful?

  2. Paul Graham1 150 Reputation points
    2025-08-19T13:30:04.6033333+00:00

    thanks for your help.

    follow-up:
    we have a Legacy enabled in a test environment and still there is no cookie issued in this step:

    POST that token to /_forms/default.aspx?wa=wsignin1.0 → expect FedAuth/rtFa cookies

    Was this answer helpful?

    2 people found this answer helpful.
  3. Jason Mott 0 Reputation points
    2025-08-19T19:47:17.8066667+00:00

    Looks like it is due to this:

    https://mc.merill.net/message/MC1097272

    Microsoft have completed the work on disabling legacy authentication. They were projecting to complete in August 2025.

    Was this answer helpful?

  4. Anonymous
    2025-08-20T01:03:35.6733333+00:00

    Hi @Paul Graham1
    Based on the update notification in Message Center, Microsoft 365 will update default settings to enhance security by blocking legacy authentication protocols and requiring admin consent for third-party app access. Changes start mid-July 2025 and complete by August 2025. Organizations should assess configurations, notify stakeholders, update documentation, and configure the Admin Consent workflow. 
    Legacy authentication protocols like RPS (Relying Party Suite) are vulnerable to brute-force and phishing attacks due to non-modern authentication. Blocking this prevents applications that are using outdated methods from accessing SharePoint and OneDrive via browser.  
    For more details, visit the Microsoft 365 Admin Center: https://admin.microsoft.com/?ref=MessageCenter/:/messages/MC1097272 

    I hope this information is helpful. 

    Was this answer helpful?

  5. Wiese 25 Reputation points
    2025-08-21T08:27:42.45+00:00

    we migrated to token-based authentication using Azure AD.

    Here’s how it works now:

    Token-based authentication

    Instead of sending the FedAuth cookie, we send an access token in the Authorization header of every HTTP request to SharePoint.

    App-based access

    The access token is obtained from an Azure AD app registration. This means that access is granted to the application itself (app-based authentication), rather than to a specific user.

    JWT signing requirement

    To request an access token, the client must present a signed JWT. The JWT is signed using the private key of a certificate. The public certificate must be uploaded to the Azure AD app registration so that Azure AD can validate the signature.

    This setup removes dependency on user context and enables secure, app-only access to SharePoint resources.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.