SAML SSO with Azure AD is enabled on the Cloud account. While accessing the Cloud account url, the users encounter the error as follows:
AADSTS50105: Your administrator has configured the application <> to block users unless they are specifically granted (‘assigned’) access to the application. The signed in user ‘<>’ is blocked because they are not a direct member of a group with access, nor had access directly assigned by an administrator. Please contact your administrator to assign access to this application.
How can this be resolved?
Issue Description
SAML SSO with Azure AD is enabled on the Cloud account. While accessing the Cloud account URL, the users encounter an error as follows:
AADSTS50105: Your administrator has configured the application <> to block users unless they are specifically granted ('assigned') access to the application. The signed in user '<>' is blocked because they are not a direct member of a group with access, nor had access directly assigned by an administrator. Please contact your administrator to assign access to this application.
Resolution
For SAML SSO with Azure AD, an Enterprise application is created. The SAML SSO is enabled for this Enterprise application. In order to access the cloud account via SSO, the users have to be granted access to the Enterprise application used.
These are the steps that need to be followed:
- Sign in to the Microsoft Entra Admin Center using of the following roles: Cloud Application Administrator, or Application Administrator.
- Browse to Identity > Applications > Enterprise applications > All applications.
- Search for the Enterprise application used for the SAML SSO integration. Click and open the Enterprise application.
- Navigate to User and Groups in the left navigation panel. Click on Add user/group.
- A new screen will open. Click on None Selected, search and check the users in the new side window, click Select, and finally click Assign.
Once the above configuration is completed, the affected users should delete cookies, restart browser, and access the Cloud URL to login via SAML SSO.