cisagov / ScubaGear

Automation to assess the state of your M365 tenant against CISA's baselines
https://www.cisa.gov/resources-tools/services/secure-cloud-business-applications-scuba-project
Creative Commons Zero v1.0 Universal
1.76k stars 226 forks source link

Could not connect to SharePoint Online: Legacy Auth blocked by ADFS Claim rule #1414

Open buidav opened 1 week ago

buidav commented 1 week ago

🐛 Summary

Public Issue #1407 reported that they could not authenticate to SharePoint Online via Interactive Auth and shared this error message

Could not connect to SharePoint Online

Microsoft documentation says this can be caused by a ADFS claim rule blocking legacy auth


Fix is to use Modern Auth by default. Adding these additional parameters to the Connect-SPOService call in Connection.psm1

Connect-SPOService -Url https://REPLACEWITHYOURTENANTNAME-admin.sharepoint.com -ModernAuth $true -AuthenticationUrl https://login.microsoftonline.com/organizations

Don't think we need to continue supporting the legacy auth for SPO. So, no need for any conditionals or retry mechanism for Legacy auth in case Modern Auth fails.

To reproduce

Requires ADFS claim rule blocking legacy auth to recreate this error.

Expected behavior

Successful SharePoint Authentication