We have an existing enterprise application in Microsoft Entra ID that uses SAML authentication. A newly added user cannot sign in, even though the sign-in logs show that the user passes the Conditional Access policies. The failure indicates that the user is not permitted to use the application.
The user is assigned directly under the enterprise application's Users and groups section rather than through a group. The application settings and SAML attribute mappings appear to match those of working users, including the user principal name format. The account's directory attributes also look identical to those of a user who can sign in.
What else should we check to determine why this particular user is being denied?
3 Answers
It may be a stale sign-in session rather than an assignment problem. Have the user sign out of the Microsoft account and the application completely, then retry in a private window or a separate browser profile. If the user has multiple Entra accounts, make sure the browser is using the account that is actually assigned to the enterprise application. The application may also need its own SAML session cleared.
As a reset test, remove the user's application assignment, remove any corresponding user record from the application itself if one exists, and then add the assignment again. After that, have the user start a fresh sign-in. This can clear a stale provisioning or authorization record that is not obvious in the Entra settings.
Start by comparing the exact identifier being sent in the SAML assertion with the identifier expected by the application. Confirm that the assigned account's UPN or email matches the account configured in the application, and verify that all required claims are being populated. Comparing a SAML trace from a working user with one from the affected user can reveal a subtle difference that the directory profile does not show.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures