You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# For more information, see https://learn.microsoft.com/en-us/help/platform/learn-editor-add-metadata
4
-
# For valid values of ms.service, ms.prod, and ms.topic, see https://learn.microsoft.com/en-us/help/platform/metadata-taxonomies
5
-
6
-
title: 'Error AADSTS76021 (ApplicationRequiresSignedRequests) with SAML authentication: The request sent by client is not signed'
2
+
title: "Error AADSTS76021 (ApplicationRequiresSignedRequests) with SAML authentication: The request sent by client is not signed"
7
3
description: Describes a problem in which a user receives the error AADSTS76021 when trying to sign-in
8
-
author: custorod # GitHub alias
9
-
ms.author: custorod
4
+
ms.author: jarrettr
5
+
author: JarrettRenshaw
6
+
ms.topic: troubleshooting
10
7
ms.service: entra-id
11
8
ms.topic: troubleshooting-problem-resolution
12
9
ms.date: 01/14/2026
13
-
ms.subservice: authentication
10
+
ms.custom: sap:Issues Signing In to Applications
14
11
---
15
12
# Error AADSTS76021 (ApplicationRequiresSignedRequests) with SAML authentication: The request sent by client is not signed
16
13
17
-
## Overview
18
-
The error **AADSTS76021** occurs during federated authentication with Microsoft Entra ID when using SAML-based Single Sign-On (SSO). This error indicates that the request sent by the client is not signed while the application requires signed requests. Even if the request is signed, the signature might not be placed according to the SAML binding configuration.
14
+
## Summary
15
+
16
+
The error **AADSTS76021** occurs during federated authentication with Microsoft Entra ID when using SAML-based Single Sign-On (SSO). This error indicates that the request sent by the client isn't signed while the application requires signed requests. Even if the request is signed, the signature might not be placed according to the SAML binding configuration.
19
17
20
18
According to [SAML specifications](https://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf), two primary and most commonly used binding types exist:
21
19
22
-
-**HTTP-Redirect**[urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect]: For HTTP GET requests, the signature is included as a query parameter in the URL.
20
+
-**HTTP-Redirect**[urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect]: For HTTP get method (GET) requests, the signature is included as a query parameter in the URL.
23
21
-**HTTP-POST**[urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST]: For HTTP POST requests, the signature is embedded within the XML payload of the SAML message.
24
22
25
-
If the application expects the signature in one location but the request uses another binding type, Microsoft Entra ID will reject the request, resulting in **AADSTS76021**.
23
+
If the application expects the signature in one location but the request uses another binding type, Microsoft Entra ID rejects the request, resulting in the **AADSTS76021** error.
26
24
27
-
---
25
+
## Resolution
28
26
29
-
## Resolution Steps
30
-
1.**Verify SAML Binding Type**
31
-
- Check whether the application expects HTTP-Redirect or HTTP-POST.
27
+
1.**Verify SAML binding type**
32
28
33
-
2.**Ensure Configuration Matches**
34
-
- Confirm that the Identity Provider (IdP) and Service Provider (SP) configurations align.
29
+
Check whether the application expects HTTP-Redirect or HTTP-POST.
35
30
36
-
3.**Validate Signature Placement**
37
-
- For HTTP-Redirect: Signature must be in the query string.
38
-
- For HTTP-POST: Signature must be inside the XML `<Signature>` element.
31
+
2.**Ensure configuration matches**
39
32
40
-
4.**Update Application or IdP Configuration**
41
-
- Align binding type and signature placement.
42
-
- In Microsoft Entra ID, confirm SAML settings under **Enterprise Applications > Single Sign-On**.
33
+
Confirm that the Identity Provider (IdP) and Service Provider (SP) configurations align.
43
34
44
-
---
35
+
3.**Validate signature placement**
36
+
37
+
- For HTTP-Redirect: Signature must be in the query string.
38
+
- For HTTP-POST: Signature must be inside the XML `<Signature>` element.
39
+
40
+
4.**Update application or IdP configuration**
41
+
42
+
- Align binding type and signature placement.
43
+
- In Microsoft Entra ID, confirm SAML settings under **Enterprise Applications > Single Sign-On**.
45
44
46
45
## Examples
47
46
48
-
### Example 1: HTTP-Redirect Binding (GET)
49
-
Signed request includes query parameters:
47
+
### Example 1: HTTP-Redirect binding (GET)
48
+
49
+
The signed request includes query parameters like the following example:
@@ -70,39 +73,37 @@ Signed request includes signature inside XML:
70
73
</samlp:AuthnRequest>
71
74
```
72
75
73
-
---
76
+
### SAML 2.0 bindings
74
77
75
-
## More Information
76
-
77
-
### SAML 2.0 Bindings
78
78
SAML 2.0 defines several protocol bindings that map SAML request and response message exchanges onto standard communication protocols. These bindings specify rules for message encoding, signature placement, and transport security.
79
79
80
-
### 1. HTTP-Redirect Binding
80
+
#### HTTP-Redirect binding
81
+
81
82
-**Description**: Uses HTTP GET requests where SAML messages are transmitted as query parameters.
82
-
-**Use Case**: Common for initiating authentication requests.
83
+
-**Use case**: Common for initiating authentication requests.
84
+
85
+
#### HTTP-POST binding
83
86
84
-
### 2. HTTP-POST Binding
85
87
-**Description**: Uses HTTP POST requests where SAML messages are embedded in the body as XML.
86
-
-**Use Case**: Common for sending signed assertions securely.
88
+
-**Use case**: Common for sending signed assertions securely.
89
+
90
+
#### HTTP-Artifact binding
91
+
92
+
-**Description**: Exchanges small artifacts through HTTP which are later resolved into full SAML messages.
93
+
-**Use case**: Reduces message size in front-channel communication.
87
94
88
-
### 3. HTTP-Artifact Binding
89
-
-**Description**: Exchanges small artifacts via HTTP, which are later resolved into full SAML messages.
90
-
-**Use Case**: Reduces message size in front-channel communication.
95
+
#### Simple Object Access Protocol (SOAP) binding
91
96
92
-
### 4. SOAP Binding
93
97
-**Description**: Uses SOAP over HTTP for back-channel communication.
94
-
-**Use Case**: Common for artifact resolution and management operations.
98
+
-**Use Ccase**: Common for artifact resolution and management operations.
99
+
100
+
#### Reverse SOAP (PAOS) binding
95
101
96
-
### 5. PAOS Binding
97
102
-**Description**: Reverse HTTP binding used for Enhanced Client or Proxy (ECP) profiles.
For a full list of Active Directory Authentication and authorization error codes, see [Microsoft Entra authentication and authorization error codes](/azure/active-directory/develop/reference-aadsts-error-codes).
105
-
106
-
[!INCLUDE [Azure Help Support](../../../includes/azure-help-support.md)]
107
-
108
-
---
109
+
For a full list of Active Directory Authentication and authorization error codes, see [Microsoft Entra authentication and authorization error codes](/azure/active-directory/develop/reference-aadsts-error-codes).
0 commit comments