Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsFirst find out whether the identity provider (IdP) is actually down. Check how many users and applications are affected, confirm the provider’s status, and capture sign-in logs before changing configuration. A failed login can also come from MFA, account assignment, SAML settings, the application, or the user’s network.
1. Establish the scope before changing settings
Record when the failures began and check whether they affect one person, one application, or multiple people and applications that use the same IdP. A sudden failure across several apps is a stronger reason to investigate a provider incident than a failure limited to one account or service.
As an Amazon Associate I earn from qualifying purchases.
Check the IdP’s public status page and any incident notices. If your organization uses Okta, its Admin Console status section reports cell performance using states such as Operational and Degradation. If it says Failed to load, the status retrieval failed; that result alone does not establish an outage. Refresh or check the public status source.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallFor previously working sign-ins that suddenly fail, OpenAI’s SSO guidance recommends checking service status before changing IdP or network configuration. A provider status page can help distinguish a broad incident from a tenant-specific problem, but it does not identify every cause of an individual login failure.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
2. Capture the failure details in the IdP logs
Before resetting accounts, changing policies, or editing SSO settings, save the evidence needed to identify where the login stopped. In Microsoft Entra, filter sign-in logs by user or application and select failed sign-ins. Review the failure reason and additional details; documented examples include incomplete MFA, invalid credentials, an internal retry allowance, and an expired session or reauthentication check.
- Record the timestamp and time zone, affected username and user ID, application, exact error text, error code, and correlation ID.
- Note whether the error appears before MFA, during MFA, after the user completes MFA, or after the browser returns to the application.
- Include the failure reason and additional details from the log. Microsoft Learn explains: “The Failure reason describes the error. The Additional Details provides more details and often tells you how to resolve the issue.”
- Keep passwords, session cookies, access tokens, and other secrets out of tickets and screenshots.
These records help distinguish a rejected credential or MFA challenge from a later SSO or application problem. Microsoft documents error codes such as 50058, 90025, 500121, and 70046 as diagnostic identifiers; they are not outage statistics, and a code should be interpreted with its accompanying log details.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
3. Identify which stage of sign-in is failing
Use the last successful step and the available logs to narrow the investigation. Authentication at the IdP and access granted by the application are related but separate outcomes: the IdP can authenticate a person and issue a SAML response, yet the application can still reject that response.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →| Observed failure | Where to investigate first |
|---|---|
| Sign-in fails before the user reaches the application | IdP sign-in logs, credentials, account state, and the failure reason. |
| The failure occurs at MFA | MFA enrollment, the configured factor, and whether that factor can be reached. |
| The IdP reports successful authentication, but the application shows an error | Whether a token or SAML response was issued, then the application’s acceptance of it and its own logs. |
| Only particular users cannot access an otherwise working application | Account provisioning, application or group assignment, and identity mapping. |
| Several IdP-connected applications fail for many users at once | Provider status and incident notices, followed by tenant-wide sign-in logs. |
For Microsoft Entra SAML sign-in testing, a successful IdP sign-in involves Entra issuing a SAML response for the application to use. An error on the application page after that response is issued points toward the application’s acceptance of the response, rather than proving that IdP authentication failed.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. For SAML failures, check the request and response
If the application uses SAML, capture the error and SAML request, then compare the values on both sides of the exchange. Check that the request destination matches the IdP’s SSO service URL, the issuer matches the application identifier configured in the IdP, and the Assertion Consumer Service (ACS) URL matches the endpoint expected by the application.
If the response reaches the application but is rejected, check the NameID value and format, the claims, and the signing certificate. Ask the application vendor which field or condition the application requires if those checks do not explain the rejection.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
AWS IAM Identity Center illustrates why exact endpoint and account matching matter: the IdP’s NameID must match an existing username, and the ACS URL configured at the IdP must match the service URL. AWS advises: “Ensure that these two values match exactly.” For external-IdP login failures in IAM Identity Center, AWS points administrators to the CloudTrail ExternalIdPDirectoryLogin event.
5. Check assignment, provisioning, and identity mapping
When the IdP authenticates a user but the target service denies access, verify the person’s service account and how their identity is mapped. Check that the user exists and is provisioned, has the correct application and group assignments, and is represented by the identifier the service expects.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
For AWS IAM Identity Center, users must be pre-created or provisioned; SAML federation does not create them just in time. For OpenAI workspace access, its SSO troubleshooting guidance directs administrators to check IdP application assignment, workspace invitation or membership, SCIM group assignment or synchronization, and email mapping.
6. Treat MFA, browser, and network issues as separate branches
If the failure occurs at MFA
Check whether the user completed enrollment and whether the configured factor is available. If email delivery is delayed and the IdP remains operational, an already enrolled and permitted alternative—such as Okta Verify, a security key, or SMS—may help. An alternate factor can address a factor-specific delivery problem; it cannot restore an unavailable IdP. Do not assume a physical security key will work unless the IdP supports it and the user has enrolled it.
If the sign-in may involve a stale session or application path
Where organizational policy permits, try a private browser session or the application’s direct link. These checks can help distinguish a stale browser session or an application routing problem from a broader authentication failure. They do not replace reviewing the IdP logs.
If the issue may be on the network path
VPNs, proxies, browser extensions, firewalls, and other network controls can block authentication requests. OpenAI’s SSO troubleshooting guidance recommends checking the network path and required domains. Compare results only through routes approved by your organization; do not bypass security controls to test a login.
Quick Recap
7. Decide whether to wait, investigate, or escalate
- A provider incident is confirmed: follow the provider’s updates and avoid repeated configuration changes while service is recovering.
- Status is operational, or the failure is limited to a tenant, app, or user group: use the log evidence to investigate the affected branch—authentication, MFA, SAML, assignment, provisioning, application acceptance, or network.
- You need provider or application support: provide the correlation ID, timestamp and time zone, error code and text, affected account and app, failure stage, relevant SAML request or response details, and recent configuration changes. Remove secrets and credentials. Microsoft notes that a correlation ID and timestamp help support engineers identify a SAML issue.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
