How SSO errors surface

When a Microsoft sign-in fails, the user is redirected back to the Xelon HQ login page and the message is shown as a notification. For configuration and library problems the browser message is deliberately generic — one of:

• “Microsoft sign-in is currently unavailable. Please try again later or contact your administrator.”
• “Microsoft sign-in is not fully configured for your organization. Please contact your administrator.”

The specific technical cause is written to the organization's activity log under the saml log name, never placed in the URL. Assertion-validation failures return a more specific message. Use the log entry, not just what the user reports, to identify the cause.

"Continue with Microsoft" never appears

After entering an email and clicking Next, the user is asked for a password instead of seeing the Microsoft button.

• The email's domain is not in SSO Domains, or the domain is still Pending verification.
• Fix: add and verify the domain — Microsoft Authentication → SSO Domains. Only verified domains trigger Microsoft sign-in.

Login fails on signature validation

Log message similar to “SAML assertion validation failed” or “Rejected signature algorithm … Only rsa-sha256 and stronger are accepted.”

• The certificate in Xelon HQ does not match the key Entra is currently signing with, or Entra is signing with SHA-1.
• Fix: download the Active certificate from Entra (Single sign-on → SAML Certificates, Base64) and add it in the X.509 Certificate section. Ensure Entra's signing option is SHA-256.
• If you are mid-rotation, confirm the new certificate was uploaded to Xelon HQ before it was activated in Entra. See Certificate rotation.

Login fails with "Issuer binding failed"

• The Issuer in the assertion does not exactly equal the Microsoft Entra Identifier stored in Xelon HQ.
• Fix: copy the exact value from Entra's "Set up" section (Microsoft Entra Identifier) into the Identity Provider (IdP) section — watch for a trailing slash or a truncated paste.

Login fails with "No active IdP certificate"

• There is no non-expired certificate in the X.509 Certificate section.
• Fix: upload a current Base64 certificate from Entra. Certificates past their expiry date show an Expired badge and are not used.

Login fails with "Assertion has expired" / "not yet valid"

• The server clock and the assertion timestamps differ by more than the allowed tolerance (60 seconds by default).
• Fix: this is an infrastructure clock-sync issue — contact Xelon support so the platform clock can be checked against NTP.

Login fails with "Replay attack detected"

• The same assertion was submitted twice — usually from reloading the callback URL or using the browser Back button during login.
• Fix: start the login again from the Xelon HQ login page. Each assertion is single-use by design.

Login rejected: "not assigned to any group"

• The assertion arrived with no group values at all — the group claim is not being emitted by Entra.
• Fix: in the Entra application, Attributes & Claims → Add a group claim → Security groups → Group ID. Confirm the claim name matches the Group claim field in the Attribute Claims section.

Login rejected: "not a member of any group that is mapped"

• The user's groups came through, but none of them has a Group → Permission Bundle.
• Fix: add the user to an Entra group that has a bundle, or create a bundle for one of the user's existing groups. Make sure the bundle's Entra Group Object ID is the group's Object ID UUID, not its name.

Login fails: email claimed by another organization

• The email address in the assertion already belongs to a Xelon HQ user in a different organization. This is blocked to prevent cross-tenant privilege escalation.
• Fix: contact Xelon support to resolve the account conflict.

A user's permissions changed unexpectedly

• Group-based permissions are re-evaluated on every SSO login. Removing a user from an Entra group removes the corresponding Xelon HQ permissions on their next sign-in; the union of all matching bundles is granted, and non-matching bundles are revoked.
• If Graph lifecycle sync is enabled, membership changes can also apply between logins, while the user is online.

Graph sync shows "failed"

• Use Test connection in the Lifecycle Sync (Microsoft Graph) section for a specific error. Common causes:
  • Client secret expired — create a new one in Entra and paste the Value.
  • Admin consent not granted — in the App registration, API permissions → Grant admin consent.
  • Wrong App registration — the Directory (Tenant) ID and Application (Client) ID must be from the Graph App registration, not the SAML enterprise application.

Graph sync shows "re-syncing"

The delta token expired (normal after a long idle period). The next run does a full re-scan and the badge clears on its own.

A breaking-glass user cannot log in

• The email must match exactly what was registered.
• The breaking-glass bypass only applies while SSO is enabled.
• A forgotten password must be reset by another administrator with the manage users permission. The permissions of a breaking-glass account cannot be edited.

Everyone is locked out

Sign in with a breaking-glass account (password login, on the normal login page). Those accounts hold allow_manage_microsoft_authentication, so you can open Microsoft Authentication, fix the configuration, or turn Enable SSO off. If no breaking-glass credentials are available, contact Xelon support.