Unable to get FEDAuth via VBA (Excel O365) from SharePoint Online - vba

Question

I am trying - since days - to get an FEDAuth cookie from my SharePoint Online Server via VBA.
As a guide i use https://allthatjs.com/2012/03/28/remote-authentication-in-sharepoint-online/
From STS i get the response and the BinarySecurityToken.
With this token i build my POST-request to https://yourdomain.sharepoint.com/_forms/default.aspx?wa=wsignin1.0
The response (status 200) is every time an access deny-page without any cookie.
Here ist the VBA-code for this request:
Private Function GetAuthCookies(token, tendant, hostnameServer As String) As String
'implemented here: (->)
'1. Send SAML Request including username, password to Microsoft Online {STS}
'2. recieve Response including security token
'3. -> send secutity Token to SharePoint Online
'4. -> recieve authentication token
'5. send the request including athentication token... thats it!
Dim Request As Object
Dim RequestStr, Cookie As String
Dim DomainURL As String
Set Request = CreateObject("WinHttp.WinHttpRequest.5.1")
DomainURL = "https://" & tendant & ".sharepoint.com/_forms/default.aspx?wa=wsignin1.0"
RequestStr = "t=" & token
Request.Open "POST", DomainURL, False
Request.setRequestHeader "Host", hostnameServer
Request.setRequestHeader "User-Agent", "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)"
'Request.setRequestHeader "Content-Type", "text/html; charset=UTF-8"
Request.setRequestHeader "Content-Type", "text/html"
Request.setRequestHeader "Content-Length", CStr(Len(RequestStr))
Request.send (RequestStr)
Debug.Print RequestStr
Debug.Print Request.Status
Debug.Print Len(RequestStr)
If Request.Status = 200 Then
GetAuthCookies = Request.responseText
Debug.Print Request.responseText
'extract cookies tbd after positive response
End If
End Function
The RequestStr looks like:
t=EwDwAk6hBwAU... ...HwYSZL5gNgI=&p=
and hostnameServer looks like:
tendant & ".sharepoint.com"
If i go to my server via browser, i see the same behavior for the root-page (access deny page). But on the subsites e.g /sites/CA-AZ/ i have my access and in my browser i see the FEDAuth-cookie when i examine the website via edge browser.
I think the basic issue is: no access on the root-site - maybe i have to add something to identify my "point of interest" in the POST-request (/sites/CA-AZ/) ?
For the solutions i am resticted to VBA in Excel - company restrictions for my issues.
Thanks for support :-)