Resolving common issues with Auvik SSO and Microsoft Entra ID

Overview

This article explains common configuration and login issues when using SAML-based single sign-on between Auvik and Microsoft Entra ID, formerly known as Azure Active Directory.

It covers:

• The difference between authentication and authorization
• Where to configure SSO in a multi-site environment
• Microsoft Entra ID guest accounts
• The difference between SAML SSO and Microsoft OAuth
• User invitations and provisioning
• Common login and SAML claim issues

Before you begin

Before troubleshooting, confirm that:

• SAML SSO has been configured in Auvik.
• The user exists in Microsoft Entra ID and has access to the Auvik enterprise application.
• The user has been invited to Auvik.
• The email address in the user’s Auvik profile matches the identifier sent by Microsoft Entra ID.
• The applicable Auvik site is configured to use SSO for the user.

Auvik does not currently support just-in-time user provisioning for SAML SSO. Users must be invited to Auvik before they can sign in.

For initial configuration instructions, see Configuring Auvik single sign-on with Azure AD.

Understand authentication and authorization

The Auvik SAML integration controls authentication.

Authentication determines how a user proves their identity when signing in to Auvik.

The integration does not use Microsoft Entra ID groups or roles to determine which Auvik sites a user can access. Site access and permissions are managed separately within Auvik.

This means:

• Microsoft Entra ID authenticates the user.
• Auvik determines which sites the user can access.
• Auvik user roles determine what the user can do within those sites.
• Microsoft Entra ID groups and application roles are not automatically mapped to Auvik site permissions.

Configure SSO in a multi-site environment

Authentication methods and SSO configurations are applied according to the user’s authentication level in Auvik.

Where possible, configure SSO at the highest applicable multi-site level and manage access to individual sites through Auvik user authorizations.

This approach can help:

• Reduce duplicate SSO configurations
• Simplify certificate and claim updates
• Provide a consistent login experience
• Keep site access management within Auvik

Before changing an existing configuration, review the authentication levels assigned to affected users. A user may inherit an authentication method from another site or multi-site.

Microsoft Entra ID guest accounts

Microsoft Entra ID guest accounts can authenticate through SAML when they are properly assigned to the Auvik enterprise application.

The guest or member designation in Microsoft Entra ID does not determine which Auvik sites the user can access.

For a guest user to access Auvik:

1. Add or invite the account to the appropriate Microsoft Entra ID tenant.
2. Assign the user access to the Auvik enterprise application.
3. Invite the user to Auvik.
4. Assign the appropriate Auvik role and site access.
5. Confirm that the identifier sent by Microsoft Entra ID matches the user’s Auvik email address.

External users who already have an Auvik account using another authentication method may not be compatible with an SSO-for-all-users configuration. In this situation, consider using Single sign-on for selected users, subject to your organization’s authentication policy.

Understand SAML SSO and Microsoft OAuth

The Log in with Microsoft option and Microsoft Entra ID SAML SSO are separate authentication methods.

Microsoft OAuth

The Log in with Microsoft option uses Microsoft OAuth. It is intended for users whose Auvik account is authorized to use a Microsoft organizational account directly.

SAML SSO

SAML users should start from the standard Auvik login form:

1. Enter the email address associated with the Auvik account.
2. Select Next.
3. Auvik redirects the user to the configured SAML identity provider.

A user configured for SAML should not select Log in with Microsoft unless the user’s Auvik account is specifically configured to use Microsoft OAuth.

Using the wrong login method may result in:

• A password prompt instead of an identity-provider redirect
• A login loop
• An authentication-provider error
• A message stating that the user cannot authenticate with the selected provider

Troubleshoot common issues

The user is not redirected to Microsoft Entra ID

Confirm that the user is entering their email address in the standard Auvik login form and selecting Next.

Also verify that:

• SSO is enabled for the applicable site.
• The user has been migrated to SSO or was invited with SSO enforced.
• The user’s authentication level points to the site containing the intended SSO configuration.
• The user is not selecting the Microsoft OAuth button.

The user receives a provider authentication error

This can occur when the selected login method does not match the authentication method assigned to the Auvik account.

Confirm whether the user should authenticate using:

• SAML SSO
• Microsoft OAuth
• Google OAuth
• An Auvik username and password

Users configured for SAML should enter their email address in the standard login form instead of selecting a social-login button.

The user returns to the login page

Confirm that the Microsoft Entra ID enterprise application is sending the required SAML response and that the response contains the expected user identifier.

Review the following items:

• The Auvik application assignment
• The reply URL, also known as the assertion consumer service URL
• The audience or entity ID
• The relay state
• The active SAML signing certificate
• The NameID format and source
• Required user claims

The invitation redirects through auth.auvik.com

A redirect through auth.auvik.com is part of Auvik’s authentication flow and does not by itself indicate that Okta is configured as the customer’s identity provider.

If authentication does not complete, review the SAML configuration and confirm that Microsoft Entra ID sends the required identifier and claims.

The NameID does not match the Auvik user

In Microsoft Entra ID, confirm that the SAML Unique User Identifier, or NameID, uses the email address associated with the user’s Auvik account.

The Azure AD configuration article specifies an email-address NameID format and maps the identifier to the applicable email attribute.

Potential mismatches include:

• The Auvik profile uses an email alias, but Entra ID sends the primary address.
• Entra ID sends the user principal name, but the Auvik account uses a different email address.
• The mail attribute is empty for a guest or synchronized account.
• Capitalization, aliases, or domain changes have created different account identifiers.

Update either the SAML claim or the user’s Auvik email address so the values match.

The user has not been created automatically

Auvik SAML SSO does not provide just-in-time provisioning.

Invite the user in Auvik and assign the required role, site access, and authentication method. When inviting a user who should use SSO, enable the option to enforce SSO where applicable.

The user can sign in but cannot access a site

Successful SAML authentication does not automatically grant access to Auvik sites.

In Auvik:

1. Open Manage Users.
2. Locate the user.
3. Review the user’s role and authorized sites.
4. Confirm the user has access to the required client or sub-site.
5. Review the user’s authentication level separately from their site authorization.

Changes to Microsoft Entra ID groups or roles do not automatically change these Auvik permissions.

Information to collect before contacting Support

If the issue continues, collect:

• The affected user’s email address
• Whether the user is a Microsoft Entra ID guest or member
• The Auvik site where SSO is configured
• The user’s Auvik authentication method and authentication level
• The exact error message
• The time of the failed login attempt, including the time zone
• A screenshot of the error
• The NameID and claims sent in the SAML response
• Confirmation that the user is assigned to the Auvik enterprise application
• Confirmation that the user’s Entra ID identifier matches their Auvik email address

Do not send private keys, passwords, session cookies, or unredacted authentication tokens.

Related articles

• Configuring Auvik single sign-on with Azure AD
• How do I configure Auvik single sign-on with my identity provider?
• How do I change which authentication methods my users can use?
• Using single sign-on (SSO) to Auvik
• How do I manage invitations for new users?