SharePoint 2016 on-premise with Azure AD - Access Denied

L Le 41 Reputation points
2023-01-06T14:18:31.93+00:00

Hello,
I have a SharePoint 2016 on-premises (single farm) configured for Azure AD SAML SSO. I followed the tutorial below and able to authenticate; however, I get an access denied message when I'm redirected to https://www.mydomain.com/_trust/ after authentication.
TUTORIAL URL
https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/sharepoint-on-premises-tutorial
ERROR MESSAGE
Access to www.mydomain.com was denied
You don't have authorization to view this page.
HTTP ERROR 403
I gave my test account full control access to my SharePoint root site collection, but no luck. Any assistance is appreciated.
Thank you in advance.

SharePoint Server
SharePoint Server
A family of Microsoft on-premises document management and storage systems.
2,206 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,380 questions
0 comments
Accepted answer
  1. Yi Lu_MSFT 17,456 Reputation points
    2023-01-18T06:45:57.2733333+00:00

    Hi @L Le

    I'm glad to hear you solve the problem ,if you have any issue about SharePoint, you are welcome to raise a ticket in this forum.

    By the way, since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others.". and according to the scenario introduced here: Answering your own questions on Microsoft Q&A, I would make a brief summary of this thread:

    Issue Symptom:
    I have a SharePoint 2016 on-premises (single farm) configured for Azure AD SAML SSO. I followed the tutorial below and able to authenticate; however, I get an access denied message when I'm redirected to https://www.mydomain.com/_trust/ after authentication.

    TUTORIAL URL
    https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/sharepoint-on-premises-tutorial

    ERROR MESSAGE
    Access to www.mydomain.com was denied
    You don't have authorization to view this page.
    HTTP ERROR 403

    I gave my test account full control access to my SharePoint root site collection, but no luck.

    Current status:
    These are the PowerShell cmds to check azure communication from the server level or any machine on which you want to implement Azure SSO.

    Invoke-WebRequest -Uri "https://login.windows.net" -UseBasicParsing
    Invoke-WebRequest -Uri "https://login.microsoftonline.com" -UseBasicParsing
    Invoke-WebRequest -Uri "https://graph.microsoft.com" -UseBasicParsing

    You could also do some trouble shooting according to this article:
    https://azurecp.yvand.net/docs/help/troubleshooting/

    After trying the methods above, it became clear it was a CORS problem. Adding https://login.microsoftonline.com to Lee's allowed origin CORS list resolved the issue.

    You could click the "Accept Answer" button for this summary to close this thread, and this can make it easier for other community member's to see the useful information when reading this thread. Thanks for your understanding!

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    1 person found this answer helpful.
    0 comments

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Yi Lu_MSFT 17,456 Reputation points
    2023-01-09T09:23:04.103+00:00

    Hi @L Le
    What environment are you using?

    These are the PowerShell cmds to check azure communication from the server level or any machine on which you want to implement Azure SSO.

    Invoke-WebRequest -Uri "https://login.windows.net" -UseBasicParsing
    Invoke-WebRequest -Uri "https://login.microsoftonline.com" -UseBasicParsing
    Invoke-WebRequest -Uri "https://graph.microsoft.com" -UseBasicParsing

    You could also do some trouble shooting according to this article:
    https://azurecp.yvand.net/docs/help/troubleshooting/

    Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    1 person found this answer helpful.
  2. L Le 41 Reputation points
    2023-01-13T13:44:34.8633333+00:00

    Hi @Yi Lu_MSFT

    Thank you for your assistance. After trying what you suggested, it became clear it was a CORS problem. Adding https://login.microsoftonline.com to my allowed origin CORS list resolved my issue.

    0 comments