Skip to content
BriefCatch
Esc
↑↓navigate↵open⌘Jpreview
On this page

Identity troubleshooting

SSO sign-in failures, the social-login mix-up, domain verification problems, and SCIM provisioning refusals — what each one means.

Most identity problems are one of a small set of known states rather than a fault. Work through the section that matches what you are seeing.

The most common problem: signing in the wrong way

Symptom: you can sign in, but your organization’s plan, credits, or documents are not there.

The Continue with Google and Continue with Microsoft buttons are social login for individual accounts. They are not your organization’s SSO connection, even when the provider is the same company. Signing in that way creates or reuses a personal identity that is separate from your organization’s, so none of your organization’s entitlements apply.

What to do: sign out completely, then sign in the way your organization provided. If your organization enforces SSO you will see “Your organization requires single sign-on.”

This is also why an invitation should be accepted from the invited address rather than an existing personal account with the same email spelling.

Sign-in errors

  • “Login failed” or “SSO authentication failed” — retry once. If it persists, confirm you are using the same identity provider account your invitation was sent to. A personal account with the same email address is a different identity.
  • “This verification link has expired” or “This reset link has expired” — request a new one. Links are single-use and time-boxed by design; retrying the old link cannot work.
  • “Organization membership is still being confirmed” — an invitation acceptance is still processing. Wait a moment before retrying.

SSO does not appear, or cannot be enabled

Work down this list:

  1. Is a domain verified? The SSO screen shows “Verify a domain before enabling SSO” until one is. See Verified domains.
  2. Is your role admin or owner? Identity settings are not visible to members.
  3. Does your plan include enterprise SSO? It is an Enterprise capability.
  4. Is the right organization active? The picker in the header decides which membership applies.

“Run a passing test sign-in first”

Enforcement is gated on a passing test sign-in that is newer than the last configuration change. The full message is:

Run a passing test sign-in first. Enforcement needs a passing test newer than the last configuration change.

If you tested successfully and then edited any field, that test no longer counts. Re-run it. This is the most common reason enforcement is refused when the connection looks healthy.

Test sign-in fails

Check these in order, because each one is a different system:

  • The certificate or metadata URL. A stale signing certificate is the most common cause. Re-read your provider’s metadata rather than editing values by hand.
  • The ACS URL and Entity ID in your provider. They must match what the BriefCatch SSO page shows, exactly.
  • The email claim. Your provider’s application must release the user’s email address; it is what BriefCatch matches on.
  • The tenant or workspace domain. For Entra ID this is the directory domain, often example.onmicrosoft.com, which is not always the same as your email domain.

Test sign-in exists so failures land on you rather than on your whole organization. Do not enable an untested connection to “see if it works in production.”

Domain verification problems

  • The check fails right after publishing the record. DNS propagation takes time. Check again rather than replacing the challenge.
  • “The DNS proof could not be verified. The domain remains pending.” The expected state before propagation completes.
  • “This domain conflicts with an existing verified claim.” Another organization already holds a verified claim on it. Contact BriefCatch support if your organization controls it — that is the intended route. (A plainer “The domain could not be added” is the general fallback for other failures, not the collision case.)

SCIM provisioning refusals

These are deliberate refusals, not transient errors. Retrying will not change the outcome.

  • A deprovision that would remove the last owner is rejected. Transfer ownership inside BriefCatch first. See Roles and permissions.
  • An inactive organization does not accept provisioning.
  • A user outside your organization’s scope is rejected. Check that your provider is scoped to the right group or directory.
  • SCIM options are unavailable entirely. Confirm SSO is connected first — “Connect SSO before setting up SCIM.”

The SCIM token is lost

Tokens are shown once, in the “Save this SCIM token now” dialog, and cannot be retrieved afterwards. Create a new token and update your identity provider with it. Do not ask support to read one back to you; nobody can.

Contacting support

Include the identity provider you use, the connection type you chose, the exact visible error, and the approximate time. Never send a SCIM token, a password, or a signing key’s private half — to BriefCatch support or to anyone who asks for them under that pretense.

Was this page helpful?