Troubleshooting SSO & SCIM
Fix common Azure AD SSO login and SCIM provisioning problems
Who this applies to
Admins fixing SSO login failures or SCIM sync issues. Learners only need the correct sign-in method once configuration is healthy.
Required permissions
- TrainMeUK Admin — SSO & Provisioning and Manage Users
- Entra Global Admin / Application Admin — consent, Redirect URI, provisioning logs
Note
Full setup steps live in Setting Up Azure AD SSO and SCIM. This page is symptom → check only. SSO and SCIM are independent — you can use SSO without SCIM.
What happens automatically
SCIM creates, updates, or deactivates users only while Entra provisioning is configured and running for assigned groups. SSO alone does not create users unless SCIM (or another create path) is also in place.
SSO login symptoms
| Symptom | Likely cause | Check | Permission | Tell support |
|---|---|---|---|---|
| Needs admin approval | App consent not granted in Microsoft 365 | A Global Admin / Application Admin must sign in once to approve the app | Microsoft admin | Tenant domain + that consent was never completed |
| Redirect error during SSO | Redirect URI mismatch | Admin → System Settings → SSO & Provisioning: Redirect URI must match Entra app registration exactly (https and trailing slash) | LMS admin + Entra admin | Both Redirect URI values (TrainMeUK vs Entra) |
| SSO button missing / not redirected | SSO disabled or domain not allowed | Enable SSO; Domain Configuration → Allowed Domains; Auto-redirect if expected | LMS admin | Whether SSO is enabled and user email domain |
| User can SSO but account Inactive | Account disabled in LMS | User Management → Enable; or check SCIM deactivation | LMS admin | User email + Active/Inactive badge |
SCIM provisioning symptoms
| Symptom | Likely cause | Check | Permission | Tell support |
|---|---|---|---|---|
| SCIM test connection fails | Wrong endpoint/token or SCIM off | SSO & Provisioning → Enable SCIM on; copy SCIM Endpoint URL and SCIM Bearer Token exactly into Entra Tenant URL / Secret Token | LMS admin + Entra admin | Whether Enable SCIM is on (do not paste the bearer token in tickets) |
| User does not appear after sync | Not in assigned Entra group / mapping error | User in assigned group; Entra Provisioning logs; user email not already in another org | Entra admin | Provisioning log error text + user UPN |
| Leaver still Active in LMS | SCIM not configured or user not in scope | Confirm SCIM provisioning is running; or Disable manually in User Management | LMS / Entra admin | Whether SCIM is enabled and last successful sync time from Entra |