Request Id: dee1bff4-7c0b-402f-a1ba-552fc0f73800 Correlation Id: f598c17d-e9c2-4999-b761-216644905986 Timestamp: 2026-07-28T16:14:22Z Message: AADSTS900561: The endpoint only accepts POST requests. Received a GET request.

Lomash Bhattarai 0 Reputation points
2026-07-28T16:19:31.2666667+00:00

Request Id: dee1bff4-7c0b-402f-a1ba-552fc0f73800

Correlation Id: f598c17d-e9c2-4999-b761-216644905986

Timestamp: 2026-07-28T16:14:22Z

Message: AADSTS900561: The endpoint only accepts POST requests. Received a GET request.

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments No comments

1 answer

Sort by: Oldest
  1. AI answer

    2026-07-28T16:19:50.0466667+00:00

    AADSTS900561 means the authentication flow sent a GET request to an endpoint that only accepts POST requests.

    For Microsoft Entra authentication flows, the token exchange must be a POST request to the token endpoint. In an OAuth 2.0 authorization code flow, the app first gets an authorization code, then must redeem that code by sending a POST request to the token endpoint with the required parameters.

    If this is happening in a browser sign-in scenario, common causes include a broken sign-in session, stale cookies, blocked third-party cookies, or browser extensions interfering with authentication. Try these steps:

    1. Sign out completely, close all browser tabs, and start a new sign-in session.
    2. Try an InPrivate/Incognito window.
    3. Clear browser cache and cookies.
    4. Allow third-party cookies.
      • In Edge: Settings > Privacy, search, and services > Cookies > turn off Block third-party cookies.
      • In Chrome: Settings > Privacy and security > Third-party cookies > select Allow third-party cookies.
    5. Temporarily disable privacy/ad-blocking browser extensions.
    6. If the issue is app-based rather than browser-based, verify the app is exchanging the authorization code for a token by sending a POST request to the token endpoint, not a GET request.

    If the error is coming from a custom or third-party application, the application owner needs to correct the authentication flow so the code redemption step uses POST.


    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.