Request to Sharepoint sign-in endpoint ?wa=wsignin1.0 returns 403

Paul Graham1 150

SAML authentication flow for our ERP integration with SharePoint stopped working for multiple customers.

In the final step of the authentication, the POST request is sent with the BinarySecurityToken in the body to the address below. Instead of returning the FedAuth authentication cookie, it responds with the HTTP code 403 - Forbidden.

https://[YourDomain].sharepoint.com/_forms/default.aspx?wa=wsignin1.0

To clarify: This is not a new development or new installation. This is something that has been working for a long time and for many customers, and recently, it stopped.

0 comments

8 answers

Wiese 25 Reputation points

2025-08-21T08:27:42.45+00:00

we migrated to token-based authentication using Azure AD.

Here’s how it works now:

Token-based authentication

Instead of sending the FedAuth cookie, we send an access token in the Authorization header of every HTTP request to SharePoint.

App-based access

The access token is obtained from an Azure AD app registration. This means that access is granted to the application itself (app-based authentication), rather than to a specific user.

JWT signing requirement

To request an access token, the client must present a signed JWT. The JWT is signed using the private key of a certificate. The public certificate must be uploaded to the Azure AD app registration so that Azure AD can validate the signature.

This setup removes dependency on user context and enables secure, app-only access to SharePoint resources.
Was this answer helpful?
David VanSickle 5 Reputation points

2025-08-21T13:25:08.0933333+00:00

Here's what we were told by Microsoft in July, no mention of specific protocol blocks above the tenant level. We specifically asked about the impact on a legacy Infoburst deployment. Yesterday, we began getting failures. I'm hoping there's a case for an exception group.

Informed you that the policy described is part of Microsoft’s Secure by Default initiative. It includes the following updates:

Blocking of legacy authentication protocols (e.g., RPS and Basic Auth)

Requirement to use modern authentication methods such as OAuth

Impact on services including Exchange Online, SharePoint Online, Microsoft Teams, and Microsoft Entra

However, this policy primarily affects tenants that manage Multi-Factor Authentication (MFA) using Security Defaults.

In your case, since your tenant manages MFA through Conditional Access Policies, this change will not impact your users—unless you have explicitly configured a policy that enforces these new settings.

In summary, because you are managing authentication through Conditional Access, you retain full control over how these policies are applied in your environment.

SColley 20 Reputation points

2025-08-22T01:22:52.9933333+00:00

Please let us know if that is the case. I assumed as Microsoft still offers app passwords when mfa is enforced (in fact enforced seems necessary to active it) that this would still allow FedAuth and rtFa cookies to work.

Danny Jansen 10 Reputation points

2025-08-22T08:52:34.15+00:00

This is not the the case. Have clients of which a few use Conditional Access policies. All clients are affected.

David VanSickle 5 Reputation points

2025-08-22T13:09:32.44+00:00

Danny, correct, that's what we were told when we reached out to Microsoft Support proactively in July, which we now know was inaccurate.

SColley 20 Reputation points

2025-08-26T14:06:45.4166667+00:00

In my user case obtaining the tokens from a browser provides a useful workaround (for low level file stuff). I already use OAuth 2.0 for interacting with other Microsoft APIs
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Anonymous

2025-08-20T01:03:35.6733333+00:00

Hi @Paul Graham1
Based on the update notification in Message Center, Microsoft 365 will update default settings to enhance security by blocking legacy authentication protocols and requiring admin consent for third-party app access. Changes start mid-July 2025 and complete by August 2025. Organizations should assess configurations, notify stakeholders, update documentation, and configure the Admin Consent workflow.
Legacy authentication protocols like RPS (Relying Party Suite) are vulnerable to brute-force and phishing attacks due to non-modern authentication. Blocking this prevents applications that are using outdated methods from accessing SharePoint and OneDrive via browser.
For more details, visit the Microsoft 365 Admin Center: https://admin.microsoft.com/?ref=MessageCenter/:/messages/MC1097272

I hope this information is helpful.
Was this answer helpful?
Danny Jansen 10 Reputation points

2025-08-20T09:13:42.4533333+00:00

That is only about updating default settings. Not changing the current setting or disabling SAML authentication for SharePoint Online with User Credentials as a whole. Legacy Authentication is vulnerable but that can be mitigated by using conditional access policies.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Jason Mott 0 Reputation points

2025-08-19T19:47:17.8066667+00:00

Looks like it is due to this:

https://mc.merill.net/message/MC1097272

Microsoft have completed the work on disabling legacy authentication. They were projecting to complete in August 2025.
Was this answer helpful?
Jake Novak 30 Reputation points

2025-08-19T19:49:48.4166667+00:00

Critically, they did not say they were disabling this as part of the post. Also, the flag that is supposed to reverse these temporarily does not have any affect on this.

David VanSickle 5 Reputation points

2025-08-22T13:31:32.1133333+00:00

Jake is spot on!

Omar Abdo 0 Reputation points

2025-08-25T21:07:14.53+00:00

David and Jake, did either of you find a solution for this?

Like the OP, one of our automated flows that used the O365 Python library and password-based authentication stopped working suddenly. Trying to get/set the legacyauthprofocols flag did not help (in fact it was initially true).

David VanSickle 5 Reputation points

2025-08-25T21:09:14.58+00:00

Still working on it, have an open ticket with Microsoft and have escalated as far as possible without a premiere support agreement.

Kyler Jheng/WIH/Wistron 0 Reputation points

2025-08-28T00:55:37.8033333+00:00

On August 20th, we found that authentication via wa=wsignin1.0 was not working, but now we are able to authenticate and obtain cookies. Is there any information about it being reopened?

David VanSickle 5 Reputation points

2025-08-28T01:51:12.9866667+00:00

Interesting, that is not the case for our tenant as we are actively working a support ticket. Just tested this.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Request to Sharepoint sign-in endpoint ?wa=wsignin1.0 returns 403

8 answers

Your answer