Microsoft sign-in issue | AADSTS76021: SAML request is not signed – Help Center

If you encounter Microsoft Entra ID error AADSTS76021 when signing in to Otter using SAML Single Sign-On (SSO), the application is configured to require signed authentication requests, but the request received by Microsoft Entra ID is not signed.

This typically occurs when Require verification certificates is enabled in Microsoft Entra ID, but Sign AuthNRequest is disabled in Otter.

Error message

You may see the following Microsoft sign-in error:

AADSTS76021: The request sent by client is not signed while the application requires signed requests.

How to resolve error AADSTS76021

To resolve this error, make sure the signed authentication request settings in Microsoft Entra ID and Otter match.

Choose the resolution that matches your organization's SAML security requirements.

Note: Microsoft Entra ID settings, navigation, and interface options may change over time. For the most up-to-date information and instructions, refer to Microsoft's official documentation. The steps and screenshots in this article may differ slightly from what you see in the Microsoft Entra admin center.

Option 1: Disable required verification certificates Allow unsigned SAML authentication requests when signed requests are not required by your organization.

If your organization does not require signed SAML authentication requests, disable the verification certificate requirement in Microsoft Entra ID.

Open the Microsoft Entra admin center.
Navigate to Entra ID → Enterprise applications → All applications and select your Otter Enterprise application.
Select Single sign-on.
Under SAML Certificates, locate Verification certificates (optional) and click Edit.
Uncheck Require verification certificates and click Save.
Return to Otter and open your workspace's Configure Single Sign-On (SSO) settings.
Under Advanced Settings (optional), confirm that Sign AuthNRequest is disabled.
Retry signing in to Otter using Microsoft Entra SSO.

Note: Disabling Require verification certificates allows unsigned SAML authentication requests. Only use this option if your organization's security requirements permit it. If signed requests are required, follow Option 2 instead.

Option 2: Enable signed authentication requests Keep verification certificate enforcement enabled and configure Otter to sign SAML authentication requests.

If your organization requires signed authentication requests, keep Require verification certificates enabled in Microsoft Entra ID and configure Sign AuthNRequest in Otter.

In Otter, open Configure Single Sign-On (SSO) and select Download Certificate.
Locate the downloaded certificate, typically otter.crt, and rename its file extension to .cer if required by Microsoft Entra ID. Do not change the certificate contents.
In Microsoft Entra ID, open your Otter Enterprise application and navigate to Single sign-on.
Under SAML Certificates, select Edit next to Verification certificates (optional).
Enable Require verification certificates, upload the Otter public certificate, and click Save.
Return to Otter and enable Sign AuthNRequest under Advanced Settings (optional).
Click Save and Test and complete the Microsoft Entra SSO authentication flow.

Expected result: Microsoft Entra ID successfully verifies the signed authentication request and allows SSO authentication to continue.

Set up SAML SSO with Microsoft Entra ID

For complete instructions on configuring Microsoft Entra ID with Otter, including creating an Enterprise application, configuring SAML settings, enabling SSO, and managing advanced security options, refer to our Microsoft Entra ID SSO setup guide.

🔐 Set up SAML SSO with Microsoft Entra ID

FAQs

What causes Microsoft Entra error AADSTS76021?

Error AADSTS76021 occurs when Microsoft Entra ID requires a signed SAML authentication request but receives an unsigned request. This can happen when Require verification certificates is enabled in Entra while Sign AuthNRequest is disabled in Otter.

Do I need to delete the verification certificate to fix AADSTS76021?

No. You do not need to delete an existing verification certificate to resolve this error. If signed authentication requests are not required, disable Require verification certificates in Microsoft Entra ID.

If signed requests are required, keep the certificate configured and enable Sign AuthNRequest in Otter.

Does disabling verification certificates disable SAML SSO security?

No. Disabling Require verification certificates removes the requirement for signed authentication requests sent to Microsoft Entra ID. It does not, by itself, disable SAML SSO or the separate verification of SAML responses sent from Microsoft Entra ID to Otter.

However, requiring signed authentication requests provides an additional security control. Follow your organization's identity and access management policies when deciding whether to enable this setting.

What should I do if AADSTS76021 continues after updating the settings?

If the error continues, verify that you updated the correct Microsoft Entra Enterprise application and that the Sign AuthNRequest setting in Otter matches your Entra verification certificate requirements.

If signed requests are required, also confirm that the correct Otter public certificate is uploaded and active in Microsoft Entra ID.

If you still cannot sign in, contact our Otter Support team and provide the error code, approximate time of the failed sign-in, and any relevant Microsoft Entra sign-in log details. Do not share private keys or SAML authentication tokens.