Enterprise SSO
Test and troubleshoot
SSO diagnostics runs live checks against your workspace and tells you, in plain terms, what is ready and what still needs attention.
In the dashboardTest SSO
What it checks
| Check | What “passing” means |
|---|---|
| OIDC discovery document | Apps and identity providers can find your endpoints automatically. |
| ID token signing algorithm | Tokens are signed with an algorithm standard libraries accept (RS256). |
| JWKS signing keys | Your public keys are published, so anyone can verify your tokens. |
| Organization SSO connections | Each organization with SSO is Ready, or the reason it isn’t is listed. |
| Login providers | Which social providers are switched on. |
Fixing an organization that isn’t ready
| Diagnostics says | Do this |
|---|---|
| no provider selected | Edit the organization and choose its identity provider. |
| no verified domain | Add at least one email domain to the organization. |
| connection not active | Edit the organization and tick SSO active. |
Common problems
| Symptom | Likely cause |
|---|---|
| “Each domain can belong to only one organization” | Another organization already claims that domain. Remove it there first. |
| The Admin Portal link says it has expired | Links last 30 minutes. Generate a new one. |
| A social button doesn’t appear | The provider is switched off or has no credentials. See Social login. |
| People are told to “ask an administrator for an invitation” | They have no account and self-service sign-up is off. |
| Sign-in is refused with “blocked by a security policy” | One of your actions denied it. Check the audit log for the reason. |