SSO Troubleshooting
Most SSO problems fall into two buckets: something a user hits while signing in, or something an admin hits while configuring the provider. If a fix isn't obvious, the Test connection button on Settings → Single Sign-On is the fastest way to check the provider itself.
The number-one cause: the redirect URI
A mistyped or missing redirect URI in Azure is by far the most common reason sign-in fails. In your Azure app's Authentication settings, the Web redirect URI must match the one shown on the CodeXray Single Sign-On settings page exactly — same host, no trailing slash. See Set Up Azure Entra ID SSO.
Errors shown on Microsoft's page
Some failures never reach CodeXray — Microsoft shows the error and the user stays on the Microsoft sign-in page. These codes start with AADSTS:
| Code | What it means | How to fix it |
|---|---|---|
| AADSTS50011 | The redirect URI doesn't match any registered URI. | In Entra → Authentication, add the exact URI from CodeXray's Single Sign-On page — same https, same host, no trailing slash. |
| AADSTS50105 | The user isn't assigned to the app, and Assignment required is on. | Enterprise application → Users and groups → assign the person (or their group) to a CodeXray app role. |
| AADSTS90002 | The directory wasn't found. | The Directory (tenant) ID is wrong — check it against Entra's Overview page. |
| AADSTS700016 | The application wasn't found in the directory. | The Application (client) ID is wrong — check it against Entra's Overview page. |
Sign-in problems (end users)
When a sign-in can't complete, CodeXray returns the user to the login screen with a plain-language message. Here's what each one means and what to do.
| Message the user sees | What it means | How to fix it |
|---|---|---|
| Your email address is not on a domain enabled for single sign-on… | The account signed in at Microsoft is on a domain your organisation hasn't registered — often a guest or personal account picked by mistake. | Use Use a different account and pick your work account. If it really is your work domain, ask your admin to add it to Email domains. |
| That account belongs to a different directory than the one configured… | The account is from a different Microsoft directory than the one your provider is configured for. | Sign in with an account from your organisation's directory. Admins: check the Directory (tenant) ID. |
| Your organisation requires single sign-on… | Password sign-in was attempted on a domain where SSO is required. | Use the Sign in with … button. Break-glass accounts can use Sign in with a password instead. |
| Single sign-on is not switched on for your organisation right now. | The provider exists but is disabled. | Ask your admin to enable it in Settings → Single Sign-On. |
| You do not have a CodeXray account yet. Ask your administrator to invite you. | You signed in successfully, but automatic account creation is off and you don't have an account yet. | Ask your admin to add you (or to turn on Create accounts on first sign-in). |
| Your account has been deactivated. Contact your organisation's administrator to restore access. | An admin has deactivated your account — your roles are kept, but sign-in is blocked (this holds even if you sign in through your directory again). | Ask your organisation's primary admin to Reactivate you from Settings → Users → Deactivated. |
| This account has been removed. Contact your organisation's administrator if you need access again. | Your account was removed from the organisation. | Ask your admin to add you back. For an SSO account, signing in through your directory again usually restores you automatically. |
| Your identity provider did not confirm your email address… | Your account already exists locally and the directory didn't mark the email verified, so it couldn't be linked. | Contact your admin. |
| An account already exists with this email address and could not be linked… | An existing account couldn't be linked to your directory identity automatically. | Contact your admin. |
| Your sign-in session expired before it finished. | The sign-in took too long, or the page was left open, and the request expired. | Simply try again from the login screen. |
| We could not verify the sign-in response… / We could not complete sign-in… | A temporary problem verifying or exchanging the sign-in with Microsoft. | Try again in a moment. If every user hits this at once, the Azure client secret has most likely expired — an admin should rotate it (see the setup guide). Otherwise, if it persists, tell your admin. |
Setup & configuration problems (admins)
These appear while saving the provider or running Test connection.
| Message | What it means | How to fix it |
|---|---|---|
| The Azure application must be registered as single-tenant… | The directory ID or issuer is common / organizations (multi-tenant). | Register the Azure app as single-tenant and use your own Directory (tenant) ID. |
| Public email domains (such as gmail.com…) cannot be used… | A public email domain was entered under Email domains. | Use only domains your organisation owns. |
| One of those email domains is already registered to another organisation. | A domain you entered is already claimed by another CodeXray organisation's provider. | Remove it, or contact support if it should belong to you. |
| Break-glass accounts must be on one of the email domains above. | A break-glass address is on a domain the provider doesn't cover, so it would have no effect. | Use a break-glass address on one of your registered domains. |
| Some of these settings are not valid… | A required field is missing or malformed — usually the Directory ID, Application ID, or Email domains. | Re-check those fields and save again. |
| Could not reach the identity provider with this configuration. (Test connection) | CodeXray couldn't fetch the directory's sign-in metadata for the Directory (tenant) ID given. | Check the Directory (tenant) ID and that the server can reach Microsoft, then re-run Test connection. This check doesn't use the client secret — a secret problem only surfaces at a real sign-in. |
A quick checklist when sign-in won't work
- Redirect URI in Azure matches the CodeXray settings page exactly (no trailing slash).
- The Azure app is single-tenant, and the Directory (tenant) ID in CodeXray matches it.
- The Application (client) ID matches, and the Client secret is the secret Value (not the Secret ID) and hasn't expired.
- The user is assigned to an app role on the Enterprise application (required when Assignment required is on), and the app-role value exactly matches a CodeXray role mapping.
- The user's email domain is listed under Email domains — include your
*.onmicrosoft.comdomain if that's what the token carries. - The provider's Single sign-on enabled toggle is on, and the user isn't deactivated.
- Test connection passes and one real sign-in in a private window works (a passing test alone isn't proof — it doesn't check the secret or assignments).
Next steps
- Set Up Azure Entra ID SSO — the full setup guide
- Signing In & Managing SSO Users — the end-user experience and user management
- SSO Overview — concepts and the sign-in flow
- Support — reach the CodeXray team if you're stuck