Checking assignment status and errors

This page summarizes how to check whether assignment, unassignment, or IdP ID changes were applied correctly. It also explains how to read a pending status and what causes an error. Finally, it covers how to fix errors and what the sync delay banner means. Currently, Microsoft Entra ID (Azure AD) is the only supported identity provider. For details on scope, see Assigning and unassigning apps for Entra ID-managed users.

Assignment status display

Specification of the in-progress assignment list shown on the “Info” tab of the service detail screen.

Item	Description
Row content	Shows progress as “In progress” or “Failed.” Only the most recent entry per user is shown.
Update / completion notice	Refreshes automatically every 60 seconds. On completion, shows “N app assignments completed.”
Auto-removal condition	A row still not reflected after about 55 minutes is hidden automatically, with no notification. A failed row is removed automatically after being shown for 24 hours.

Failure reasons

Messages shown when an assignment fails, and how to resolve them.

Failure reason	Displayed message	How to resolve it
Domain not verified	The email address domain has not been verified with the identity provider.	Verify domain ownership on the identity provider side, such as Microsoft Entra ID (Azure AD).
User not found	No account with this email address exists in the identity provider.	Check whether the account exists on the IdP side. Also check for any difference between the data selected in the picker and the data returned by the live lookup.
Already assigned	This account is already assigned to the app.	The target account is already assigned to the app. No action is needed — continue as normal.
License shortage	No available license for this app on the identity provider.	Purchase additional license seats for the app on the IdP or SaaS vendor side.
Assignment rejected	The identity provider rejected the assignment.	This error can have several causes. Check that the submitted values (especially the “app role” setting) are configured correctly.
Generic error	The identity provider could not complete this assignment.	The identity provider failed to complete the assignment process. This may be a temporary issue — retry later or contact your system administrator.

Check assignment status

You can confirm whether an assignment was applied correctly, or whether an error occurred, on the following screens.

Go to Directory > select the account > open the “Services” tab. Confirm that Microsoft Entra ID (Azure AD) and the SaaS app are both registered.
Go to Services > select the SaaS > check the “Accounts” tab for the registered account.
In the Microsoft Entra admin center, check the registered account under Entra ID > Users. See also: Microsoft Entra admin center (external site)

Unassigned apps — needs review

When you disable or delete an IdP ID with Also unassign all apps checked, it tracks apps needing manual follow-up.

Item	Description
Where it appears	Directory > target account > “Services” tab, or Services > select the SaaS > “Accounts” tab
Message shown	Apps unassigned from this person through the identity provider. Because deletion on the service side cannot be confirmed, verify that each account has actually been deleted.
After you’re done	After reviewing, click Confirm to dismiss the message from the screen.

The “Manual deletion required” group

A group that collects accounts requiring manual deletion, such as those not supported by SCIM.

Item	Description
What’s shown	Accounts requiring manual deletion, including those not confirmed or failed via SCIM.
When everything is handled	Once no unhandled accounts remain, “All handled” is displayed.
On reassignment	If a target account is reassigned, its corresponding pending entry is removed automatically.

Sync delay warning

A banner shown when syncing with the IdP is taking longer than expected, meaning the displayed data may not be current.

Item	Description
Where it appears	Services > select the SaaS > “Info” tab
Display format	Banner on IdP-related screens
Message shown	One or more IdP syncs are delayed (over X minutes). Because Microsoft Entra ID (Azure AD)‘s SCIM sync can take up to 50 minutes, the data may not be current.
Purpose	To warn that data retrieved from the IdP may not be up to date.

​Assignment status display

​Failure reasons

​Check assignment status

​Unassigned apps — needs review

​The “Manual deletion required” group

​Sync delay warning

​Related pages