Share via

SharePoint 2016 on-premise with Azure AD - Access Denied

L Le 41 Reputation points
2023-01-06T14:18:31.93+00:00

Hello,
I have a SharePoint 2016 on-premises (single farm) configured for Azure AD SAML SSO. I followed the tutorial below and able to authenticate; however, I get an access denied message when I'm redirected to https://www.mydomain.com/_trust/ after authentication.
TUTORIAL URL
https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/sharepoint-on-premises-tutorial
ERROR MESSAGE
Access to www.mydomain.com was denied
You don't have authorization to view this page.
HTTP ERROR 403
I gave my test account full control access to my SharePoint root site collection, but no luck. Any assistance is appreciated.
Thank you in advance.

Microsoft 365 and Office | SharePoint Server | For business
Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

Answer accepted by question author

Yi Lu_MSFT 17,701 Reputation points
2023-01-18T06:45:57.2733333+00:00

Hi @L Le

I'm glad to hear you solve the problem ,if you have any issue about SharePoint, you are welcome to raise a ticket in this forum.

By the way, since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others.". and according to the scenario introduced here: Answering your own questions on Microsoft Q&A, I would make a brief summary of this thread:

Issue Symptom:
I have a SharePoint 2016 on-premises (single farm) configured for Azure AD SAML SSO. I followed the tutorial below and able to authenticate; however, I get an access denied message when I'm redirected to https://www.mydomain.com/_trust/ after authentication.

TUTORIAL URL
https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/sharepoint-on-premises-tutorial

ERROR MESSAGE
Access to www.mydomain.com was denied
You don't have authorization to view this page.
HTTP ERROR 403

I gave my test account full control access to my SharePoint root site collection, but no luck.

Current status:
These are the PowerShell cmds to check azure communication from the server level or any machine on which you want to implement Azure SSO.

Invoke-WebRequest -Uri "https://login.windows.net" -UseBasicParsing
Invoke-WebRequest -Uri "https://login.microsoftonline.com" -UseBasicParsing
Invoke-WebRequest -Uri "https://graph.microsoft.com" -UseBasicParsing

You could also do some trouble shooting according to this article:
https://azurecp.yvand.net/docs/help/troubleshooting/

After trying the methods above, it became clear it was a CORS problem. Adding https://login.microsoftonline.com to Lee's allowed origin CORS list resolved the issue.

You could click the "Accept Answer" button for this summary to close this thread, and this can make it easier for other community member's to see the useful information when reading this thread. Thanks for your understanding!

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Was this answer helpful?

1 person found this answer helpful.
0 comments

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Yi Lu_MSFT 17,701 Reputation points
    2023-01-09T09:23:04.103+00:00

    Hi @L Le
    What environment are you using?

    These are the PowerShell cmds to check azure communication from the server level or any machine on which you want to implement Azure SSO.

    Invoke-WebRequest -Uri "https://login.windows.net" -UseBasicParsing
    Invoke-WebRequest -Uri "https://login.microsoftonline.com" -UseBasicParsing
    Invoke-WebRequest -Uri "https://graph.microsoft.com" -UseBasicParsing

    You could also do some trouble shooting according to this article:
    https://azurecp.yvand.net/docs/help/troubleshooting/

    Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    Was this answer helpful?

    1 person found this answer helpful.
  2. L Le 41 Reputation points
    2023-01-13T13:44:34.8633333+00:00

    Hi @Yi Lu_MSFT

    Thank you for your assistance. After trying what you suggested, it became clear it was a CORS problem. Adding https://login.microsoftonline.com to my allowed origin CORS list resolved my issue.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.