Authentication by user stopped working

[fccotech]

Looks like Microsoft stopped supporting authentication on username/password. Is there a known workarround (other then switching authentication methods)?

[reinschaap]

We experience this issue too in a webapplication and have same question. We are investigating what to do and we will share (our) possible solutions here

[ivomans]

Same problem in our webapplication since yesterday. Upon requests getting following error message:

{
    "error": {
        "code": "-2147024891, System.UnauthorizedAccessException",
        "message": {
            "lang": "nl-NL",
            "value": "Attempted to perform an unauthorized operation."
        }
    }
}

[vgrem]

Indeed, the SAML authentication method for SharePoint Online has been disabled by Microsoft. This appears to be a global service-side change and is not a bug in this library.
This is a breaking change, any code using SAML auth will fail, for instance this one:

$credentials = new UserCredentials($settings['UserName'], $settings['Password']);
$ctx = (new ClientContext($settings['Url']))->withCredentials($credentials);

What to do now?

Switch to alternative auth flow, namely the following options could be considered:

• Utilize ClientId/Secret flow docs example

$credentials = new ClientCredential($settings['ClientId'], $settings['ClientSecret']);
$ctx = (new ClientContext($settings['Url']))->withCredentials($credentials);

• Utilize Certificate flow docs example

$ctx = (new ClientContext($settings['Url']))->withClientCertificate(
    $settings['TenantName'], $settings['ClientId'], $privateKey, $thumbprint);

[reinschaap]

Did someone already find a notice/post about this exact deprecation from Microsoft? I cannot find it

[vgrem]

@reinschaap, for instance this thread reveals some details in this regard

[fccotech]

Yes, unfortunately does not describe this authentication method.

Microsoft Support advice:

---

Set-SPOTenant -LegacyAuthProtocolsEnabled $false
Start-Sleep -Seconds 30
Set-SPOTenant -LegacyAuthProtocolsEnabled $true

After running these commands, please allow up to 30 minutes for the changes to take effect.

---

This solution worked for some environments, for some not.
Additional it might be necessary to disable Microsoft Security Defaults, after that rerun the steps above.

[F4T4LERROR]

I couldn't get CID/secret auth working, no matter what I did. But I was able to get certificate authentication (self-signed generated in Plesk) working pretty easily. If you need any specific assistance let me know and I'll provide the things I did to get it working. Not an expert, but for anyone who needs to get it working asap.

[reinschaap]

The notice: https://learn.microsoft.com/en-us/sharepoint/dev/sp-add-ins/retirement-announcement-for-azure-acs

[reinschaap]

We did solve this issue. The connection to Sharepoint is now switched to use client id and secret credential instead of user / pwd credential.

This change will also 'soon' be deprecated (April 2026), but for now it had the least impact.

The 'futureproof' fix will be these few lines:

If you are using custom developed applications or are using SharePoint provider hosted Add-Ins, we recommend switching those applications to use Microsoft Entra ID for authorization and authentication needs.

See https://learn.microsoft.com/en-us/sharepoint/dev/sp-add-ins/retirement-announcement-for-azure-acs

[rfalcesSamca]

After a full morning searching on Internet and testing I found that Sharepoint works with oauth tokens if you specify your tenant when requesting the token:
acces_token URL: https://login.microsoftonline.com/<your_tenant_name>.onmicrosoft.com/oauth2/v2.0/token
scope: "https://<your_tenant.name>.sharepoint.com/.default"
client_id: "{your Entra Id application id}"
client_secret: "{your secret value}"
grant_type: "password"
username: "{your user name}"
password: "{your user password}"

Not sure if this will work after April 2026 but is the same authentication used for Graph

[reinschaap]

I did find this interesting thread: https://learn.microsoft.com/en-us/answers/questions/5527284/request-to-sharepoint-sign-in-endpoint-wa-wsignin1

with a link to this message from Microsoft: https://mc.merill.net/message/MC1097272 which could indicate why the services stopped at august 18 ..

[anykeysolutions]

Could you please give some details on how you got this working again? I can't seem to fix it with ClientId/Secret flow

[glesiakft]

Vgrem posted a method that should work until April 2026, what's the best way to use this library with entra ID for the long term?

[fccotech]

Yes, unfortunately does not describe this authentication method.

I think:

Set-SPOTenant -LegacyAuthProtocolsEnabled $false Wait... Set-SPOTenant -LegacyAuthProtocolsEnabled $true

Will reset the setting after some time (this is what i think, cannot verify fully). Alhough Get-SPOTenant | Select-Object LegacyAuthProtocolsEnabled says it's already set to true. (My test environment is working again).

Yes, unfortunately does not describe this authentication method.

Microsoft Support advice:

Set-SPOTenant -LegacyAuthProtocolsEnabled $false Start-Sleep -Seconds 30 Set-SPOTenant -LegacyAuthProtocolsEnabled $true

After running these commands, please allow up to 30 minutes for the changes to take effect.

This solution worked for some environments, for some not. Additional it might be necessary to disable Microsoft Security Defaults, after that rerun the steps above.

I updated this comment with some new Insights from Microsoft Support

[fccotech]

Vgrem posted a method that should work until April 2026, what's the best way to use this library with entra ID for the long term?

I've evaluated some options, if you don't want to disable security defaults or invest in Conditional Access policies. It looks like the only viable long term solution is a rewrite to Graph.

We did a rewrite in the past days, not fun, but the Graph API is pretty solid.