> ## Documentation Index
> Fetch the complete documentation index at: https://support.i.moneyforward.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Checking assignment status and errors

> How to check assignment status, the causes of and fixes for assignment errors, and the warning banners shown on screen.

This page summarizes how to check whether assignment, unassignment, or IdP ID changes were applied correctly. It also explains how to read a pending status and what causes an error. Finally, it covers how to fix errors and what the sync delay banner means.

Currently, Microsoft Entra ID (Azure AD) is the only supported identity provider. For details on scope, see [Assigning and unassigning apps for Entra ID-managed users](/en/it-management/idp-account-management/entraid-app-assignment).

<h2 id="assignment-status-display">
  Assignment status display
</h2>

Specification of the in-progress assignment list shown on the "Info" tab of the service detail screen.

| Item                       | Description                                                                                                                                                           |
| -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Row content                | Shows progress as "In progress" or "Failed." Only the most recent entry per user is shown.                                                                            |
| Update / completion notice | Refreshes automatically every 60 seconds. On completion, shows "N app assignments completed."                                                                         |
| Auto-removal condition     | A row still not reflected after about 55 minutes is hidden automatically, with no notification. A failed row is removed automatically after being shown for 24 hours. |

<h2 id="failure-reasons">
  Failure reasons
</h2>

Messages shown when an assignment fails, and how to resolve them.

| Failure reason      | Displayed message                                                          | How to resolve it                                                                                                                                                 |
| ------------------- | -------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Domain not verified | The email address domain has not been verified with the identity provider. | Verify domain ownership on the identity provider side, such as Microsoft Entra ID (Azure AD).                                                                     |
| User not found      | No account with this email address exists in the identity provider.        | Check whether the account exists on the IdP side. Also check for any difference between the data selected in the picker and the data returned by the live lookup. |
| Already assigned    | This account is already assigned to the app.                               | The target account is already assigned to the app. No action is needed — continue as normal.                                                                      |
| License shortage    | No available license for this app on the identity provider.                | Purchase additional license seats for the app on the IdP or SaaS vendor side.                                                                                     |
| Assignment rejected | The identity provider rejected the assignment.                             | This error can have several causes. Check that the submitted values (especially the "app role" setting) are configured correctly.                                 |
| Generic error       | The identity provider could not complete this assignment.                  | The identity provider failed to complete the assignment process. This may be a temporary issue — retry later or contact your system administrator.                |

<h2 id="check-assignment-status">
  Check assignment status
</h2>

You can confirm whether an assignment was applied correctly, or whether an error occurred, on the following screens.

* Go to **Directory** > select the account > open the "Services" tab. Confirm that Microsoft Entra ID (Azure AD) and the SaaS app are both registered.
* Go to **Services** > select the SaaS > check the "Accounts" tab for the registered account.
* In the Microsoft Entra admin center, check the registered account under **Entra ID** > **Users**. See also: [Microsoft Entra admin center (external site)](https://entra.microsoft.com/)

<h2 id="unassigned-apps-need-review">
  Unassigned apps — needs review
</h2>

When you disable or delete an IdP ID with **Also unassign all apps** checked, it tracks apps needing manual follow-up.

<img src="https://mintcdn.com/moneyforwardi/AltAQbgvkgrjVl2T/images/it-management/idp-account-management/assignment-status/unassigned-apps-need-review.png?fit=max&auto=format&n=AltAQbgvkgrjVl2T&q=85&s=a35d79aa91984b7980ecfc30dbf35c1b" alt="The Services tab showing the Unassigned apps — needs review banner with affected services and unassignment times" width="1920" height="346" data-path="images/it-management/idp-account-management/assignment-status/unassigned-apps-need-review.png" />

| Item              | Description                                                                                                                                                                   |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Where it appears  | Directory > target account > "Services" tab, or Services > select the SaaS > "Accounts" tab                                                                                   |
| Message shown     | Apps unassigned from this person through the identity provider. Because deletion on the service side cannot be confirmed, verify that each account has actually been deleted. |
| After you're done | After reviewing, click **Confirm** to dismiss the message from the screen.                                                                                                    |

<h2 id="manual-deletion-required-group">
  The "Manual deletion required" group
</h2>

A group that collects accounts requiring manual deletion, such as those not supported by SCIM.

| Item                       | Description                                                                                  |
| -------------------------- | -------------------------------------------------------------------------------------------- |
| What's shown               | Accounts requiring manual deletion, including those not confirmed or failed via SCIM.        |
| When everything is handled | Once no unhandled accounts remain, "All handled" is displayed.                               |
| On reassignment            | If a target account is reassigned, its corresponding pending entry is removed automatically. |

<h2 id="sync-delay-warning">
  Sync delay warning
</h2>

A banner shown when syncing with the IdP is taking longer than expected, meaning the displayed data may not be current.

| Item             | Description                                                                                                                                                   |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Where it appears | Services > select the SaaS > "Info" tab                                                                                                                       |
| Display format   | Banner on IdP-related screens                                                                                                                                 |
| Message shown    | One or more IdP syncs are delayed (over X minutes). Because Microsoft Entra ID (Azure AD)'s SCIM sync can take up to 50 minutes, the data may not be current. |
| Purpose          | To warn that data retrieved from the IdP may not be up to date.                                                                                               |

## Related pages

* [Assigning and unassigning apps for Entra ID-managed users](/en/it-management/idp-account-management/entraid-app-assignment)
* [Disabling and deleting an Entra ID](/en/it-management/idp-account-management/entraid-id-lifecycle)
