SSO Sign-In Error Message

When MSPCFO refuses an SSO sign-in, the person goes back to the sign-in page (or, during a test, to the Single Sign-On page) with one of these messages. company and email are filled in with real values.

If the error appears on your identity provider's page (Microsoft, Google, Okta or Duo) rather than in MSPCFO, see the "problems" table at the end of your provider's setup article.

 
MessageWhat it meansWhat to do
SSO is not configured for this email domain. Please sign in with your password.No company with SSO enabled claims this email domain, or several do.Check SSO is enabled and the domain is under Company Domains. On a shared domain, existing members are still routed correctly; new people must be invited.
Your organization requires SSO login. Please use "Sign in with SSO".SSO is enforced and the person tried their password, or was signed in with one.Sign in at https://app.mspcfo.com/sso/sign_in.
Your identity provider did not confirm this email address, so we can't match it to an account. Ask your administrator to check your organization's SSO setup.The provider didn't say the email is verified. Entra: xms_edov missing. Okta: email unverified.See the provider's setup article. People already linked aren't affected.
Your identity provider did not send an email address, so we can't match your account. Ask your administrator to set an email address on your account.The provider sent no email for this person.Set the email on the person's account in your provider, and make sure the email claim/scope is sent.
Your organization's single sign-on can't create new MSPCFO accounts. Ask your administrator to invite you, then sign in with SSO.Duo only: the person has no MSPCFO account.Invite them on the Users page, then they sign in with Duo again.
<email> is not on a domain of <company>, so it cannot sign in through its SSO.The email isn't on any of your registered domains.Ask MSPCFO Support to add the domain, or correct the person's email in your provider.
<email> belongs to more than one company, so it cannot sign in through <company>'s SSO. Please sign in with your password.The person is a member of several MSPCFO companies.Expected. They use their password and two-factor code.
<email> is not a member of <company>, so its SSO cannot sign it in. Ask your administrator to invite you.The account exists but isn't in your company (for example, they were removed).Invite them on the Users page if they should have access.
<email> is on a domain that more than one company uses for SSO, so <company>'s SSO can sign it in only after the company invites it. Ask your administrator to invite you.A new address on a domain shared with another SSO company.Invite them on the Users page first.
This account is already linked to a different single sign-on identity, so it cannot sign in this way. Please sign in with your password.The person's identity provider account changed (for example, it was recreated).Unlink them under Linked users on the Single Sign-On page, then they sign in with SSO again.
Your organization requires SSO, but this account is linked to a different single sign-on identity …Same as above, while SSO is enforced.Unlink them under Linked users. MSPCFO Support can also do it.
MSPCFO staff accounts cannot sign in through a client's SSO. Please sign in with your password.An MSPCFO staff email was used.Expected. Staff always use their password.
Your identity provider did not send a user identifier, so we can't sign you in. …The provider's response had no user ID.Check the person's account and the app configuration in your provider.
SSO configuration not found. Please start again from "Sign in with SSO".The sign-in took too long, the browser's back/refresh was used, or SSO was turned off meanwhile.Start again at https://app.mspcfo.com/sso/sign_in.
SSO authentication failed. Please try again, or contact your administrator if it keeps happening.The provider returned an error, or the response couldn't be checked (often a wrong client secret).Try again. If it keeps happening, re-enter the client secret and run Test sign-in.
Your account is locked. / an inactive-account messageThe MSPCFO account is locked (too many failed attempts) or deactivated, or the company can't sign in.Wait for the lock to expire or use the unlock email. Otherwise contact MSPCFO Support.

Before contacting MSPCFO support

Have these ready:

  • the person's email address and the exact message they saw (a screenshot helps);
  • whether it happened at your identity provider's page or after coming back to MSPCFO;
  • the provider, and whether the Single Sign-On page shows Verified.

Never send the client secret to anyone, MSPCFO support included. If a secret may have been exposed,
create a new one in your provider, enter it in MSPCFO, and delete the old one.

0 Comments

Add your comment

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.