How to check assignment status, the causes of and fixes for assignment errors, and the warning banners shown on screen.
This page summarizes how to check whether assignment, unassignment, or IdP ID changes were applied correctly. It also explains how to read a pending status and what causes an error. Finally, it covers how to fix errors and what the sync delay banner means.Currently, Microsoft Entra ID (Azure AD) is the only supported identity provider. For details on scope, see Assign and unassign apps with Entra ID.
Specification of the in-progress assignment list shown on the “Info” tab of the service detail screen.
Item
Description
Row content
Shows progress as “In progress” or “Failed.” Only the most recent entry per user is shown.
Update / completion notice
Refreshes automatically every 60 seconds. On completion, shows “N app assignments completed.”
Auto-removal condition
A row still not reflected after about 55 minutes is hidden automatically, with no notification. A failed row is removed automatically after being shown for 24 hours.
Messages shown when an assignment fails, and how to resolve them.
Failure reason
Displayed message
How to resolve it
Domain not verified
The email address domain has not been verified with the identity provider.
Verify domain ownership on the identity provider side, such as Microsoft Entra ID (Azure AD).
User not found
No account with this email address exists in the identity provider.
Check whether the account exists on the IdP side. Also check for any difference between the data selected in the picker and the data returned by the live lookup.
Already assigned
This account is already assigned to the app.
The target account is already assigned to the app. No action is needed — continue as normal.
License shortage
No available license for this app on the identity provider.
Purchase additional license seats for the app on the IdP or SaaS vendor side.
Assignment rejected
The identity provider rejected the assignment.
This error can have several causes. Check that the submitted values (especially the “app role” setting) are configured correctly.
Generic error
The identity provider could not complete this assignment.
The identity provider failed to complete the assignment process. This may be a temporary issue — retry later or contact your system administrator.
When you disable or delete an IdP ID with Also unassign all apps checked, it tracks apps needing manual follow-up.
Item
Description
Where it appears
Directory > target account > “Services” tab, or Services > select the SaaS > “Accounts” tab
Message shown
Apps unassigned from this person through the identity provider. Because deletion on the service side cannot be confirmed, verify that each account has actually been deleted.
After you’re done
After reviewing, click Confirm to dismiss the message from the screen.
A banner shown when syncing with the IdP is taking longer than expected, meaning the displayed data may not be current.
Item
Description
Where it appears
Services > select the SaaS > “Info” tab
Display format
Banner on IdP-related screens
Message shown
One or more IdP syncs are delayed (over X minutes). Because Microsoft Entra ID (Azure AD)‘s SCIM sync can take up to 50 minutes, the data may not be current.
Purpose
To warn that data retrieved from the IdP may not be up to date.
