Request to Sharepoint sign-in endpoint ?wa=wsignin1.0 returns 403

Paul Graham1 150 Reputation points
2025-08-19T00:36:17.4466667+00:00

SAML authentication flow for our ERP integration with SharePoint stopped working for multiple customers.

In the final step of the authentication, the POST request is sent with the BinarySecurityToken in the body to the address below. Instead of returning the FedAuth authentication cookie, it responds with the HTTP code 403 - Forbidden.

https://[YourDomain].sharepoint.com/_forms/default.aspx?wa=wsignin1.0

To clarify: This is not a new development or new installation. This is something that has been working for a long time and for many customers, and recently, it stopped.

Microsoft 365 and Office | SharePoint | Development
0 comments

8 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Jake Novak 30 Reputation points
    2025-08-21T12:00:29.76+00:00

    Given the length of time this was unavailable, we were forced to update our code to use a different authentication method.

    To their credit, Microsoft Support did finally respond to our case number and reversed the change on our tenant (with warnings that it would become unavailable again around October). The former code we had been using for over a decade began working again at that time.

    Was this answer helpful?

    2 people found this answer helpful.
  2. Adi Roiban 25 Reputation points
    2025-08-22T09:59:15.03+00:00

    We are not talking about Basic Authentication

    This is SAML Claims-Based authentication with the Federation Authentication (FedAuth) cookie

    With the user based authentication model, we get fine grained permissions for SharePoint Files

    With OAuth2 Application ID, you only have generic site-level permisisons.

    Was this answer helpful?

    4 people found this answer helpful.
    0 comments
  3. rob.h 10 Reputation points
    2025-09-12T15:52:39.3766667+00:00

    LegacyAuthProtocolsEnabled is not sufficient. You need the setting AllowLegacyBrowserAuthProtocolsEnabledSetting. Please note that the spelling in the documentation is incorrect (the prefix “Allow” and the suffix “Setting” are missing in the documentation).

    This worked for us:

    Set-SPOTenant -AllowLegacyBrowserAuthProtocolsEnabledSetting $true

    This may not work after October 15th 2025, see https://cdm.iamcloud.info/docs/Content/RevertChange.htm

    Related link: https://mc.merill.net/message/MC1097272

    Was this answer helpful?

    2 people found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.