1

I am trying to figure out how the different authentication types in SharePoint online work. I am doing this research because I want check the impact of disabling legacy authentication in my tenant. This is a follow up on my question Question about SharePoint online credentials

Based on this image

SharePoint online authentication types

As far as I know these are the types we currently use.

When logging in from the browser:

  1. ADFS (on-prem accounts)
  2. Cloud Authentication using Cloud only account -> Azure AD as IDP

When logging in from code

  1. From code using SharePoint online credentials
  2. Using an Azure AD App registration

When I use ADFS I use federated authentication. I see that 2 cookies are set by SharePoint. These cookies are named "FedAuth" and "rtFa".

Question 1: When legacy authentication is disabled, cookie based authentication is disabled. So will ADFS still work?

Question 2: When I use cloud only accounts, am I still using federated authentication? is Azure AD used as the ADFS server? Or am I authenticated against Azure AD using other authentication type? Because in this situation I also see these cookies "FedAuth" and "rtFa" being set.

Question 3 When I connect from code using CSOM

using (ClientContext clientContext = new ClientContext("https://yoursite.sharepoint.com/"))  
{  
    SecureString passWord = new SecureString();
    clientContext.Credentials = new SharePointOnlineCredentials("loginname@yoursite.onmicrosoft.com", passWord);
    Web web = clientContext.Web;
    clientContext.Load(web);
    clientContext.ExecuteQuery();
    Console.WriteLine(web.Title);
    Console.ReadLine();
}

I see this authentication flow

Authentication flow

A cookie named "SPOIDCRL" is created and used as authentication (I can use this in Postman for example) What kind of authentication is this? A SAML token is send to the srf endpoint and I am authenticated using the idcrl.svc endopint.

This authentication type (SharePoint online credentials) stops working when I disable legacy authentication.

Using the Azure AD app registration is clear to me.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.