Troubleshooting

SSO and SAML login errors

First, get in: add /?manual=true to the URL for the normal login. Then find your error below.

"SSO not configured for this organization"

SSO hasn't been set up for your organisation yet. Follow SAML setup, or log in with a password in the meantime.

"SSO assertion rejected: email domain does not belong to this organization"

The single most common SAML misconfiguration. Your identity provider is sending an email attribute that doesn't match your organisation's domain (often a user principal name or an internal ID instead of the real address). In your provider's app settings, check which attribute is mapped to email and make sure it's the user's actual email address on your domain.

"SAML Auth Failed: ..."

Usually a certificate or signature mismatch between what your provider sent and what DMARCS has on file, typically after the provider rotated its signing certificate. Download a fresh Federation Metadata XML from your provider and upload it again on the SSO page.

Metadata upload fails with "Failed to parse XML"

The file must be a well-formed SAML metadata document containing an EntityDescriptor, an HTTP-Redirect SSO binding and an X.509 certificate. Re-export it from your provider rather than editing it by hand, and make sure you uploaded the metadata file, not a certificate or a screenshot.

OIDC token errors

"Malformed id_token", "audience mismatch", "issuer not recognized", "token expired": all of these mean the identity token DMARCS received didn't validate. Re-check the Tenant ID, Client ID and Client Secret against your provider's app registration; one of them is wrong or has been rotated.