Skip to main content

Find the answers you need

Troubleshoot: SSO login issues

This article provides troubleshooting steps for Google SSO, SAML 2.0, and OAuth 2.0 providers like Microsoft Entra ID and Okta. If users cannot log in to a third-party application that connects to Personio, such as a Marketplace integration, that's an integration issue, not an SSO issue. Learn how to troubleshoot integrations and APIs.

Before you start

  • If you see an error message when you click Test on your SSO connection, go to Fix error messages when you test your SSO connection.
  • If you use SSO via OpenID Connect / OAuth 2.0:
    • If you can't log in, it might be because your client secret has expired. When your client secret expires, Personio emails your Account Owner a recovery link and instructions. Before attempting further solutions, ask them to check their email account. They need to follow the link in the email to authenticate using email and password. They can then access Personio and update the secret. The token expires after three days.
  • If you're not experiencing the issue above, try the following:
    • Use a different browser.
    • Clear your browser cache.
    • Use incognito mode.
    • Log out and make sure you log in with the correct credentials.
    • Create a new profile on your browser of choice.
    • Disable extensions.
    • Read the frequently asked questions on SSO
  • If SSO works on desktop but not in the mobile app, the problem is usually device-related and not a configuration issue. Troubleshoot mobile app login issues.

Google SSO issues

Could not find employee for Google login

Issue:

You receive this error message: "Could not find employee for Google login".

Possible solution:

Try the following steps:

  1. Log out from Google.
  2. Log into Personio. When Google asks you to select your account, make sure to select the correct one.

Your company changes its email domain

Issue:

Your company changes its email domain.

Possible solution:

If your company changes its email domain, Personio doesn't recognize the email addresses anymore, and employees can't log in.

The integration worked in the past, but employees can't log in

Issue:

The integration worked in the past, but now your employees can't log in.

Possible solution:

Your company might have changed its email domain.

OpenID Connect / OAuth 2.0 (including Microsoft Entra ID and Okta) issues

An employee or group of employees can't log in

Issue:

An employee (or group of employees) can't log in.

Possible solution:

Try the following steps:

  1. Go to the People List and filter for those affected.
  2. Check that the employees' email addresses are correct.
  3. If the above doesn't work, check if the email addresses in Personio and the OAuth provider match.

Employees can't log in after the initial setup

Issue:

Your employees can't log in after the initial setup.

Possible solution:

Try the following steps:

  1. Go to Settings.
  2. In the Security & integrations section, click Security & authentication.
  3. From the list of login methods, go to OpenID Connect (OIDC) and click Configure.
  4. Check the settings you have in place for your identity provider:
    • Check that Scopes is set to "openid,email". Different scopes might be necessary depending on the identity provider. Check the required scopes.
    • If you have a custom identity provider, add it.
    • Check the Authorization URI.
    • Check the Token URI.
    • Check if the Callback URI is correctly set in the identity provider.
    • Check that the Issuer and JSON Web Key Sets (JWKs) URIs are set.
    • Check the expiry date of the client secret. Note that if your client secret expires, Personio emails your Account Owner with steps to regain access to Personio.
    • In the Claim field, confirm that the employee email address is the same as the email address stored in Personio.
  5. We also recommend you do the following:
    • Make sure you've already invited your employees to Personio. They each need to activate their account before they can log in.
    • For the employees who can't log in, check whether they're from a different tenant or are guest users that sync from the tenant and have a different issuer in the token. In this case, it's best to use the Microsoft Entra ID connection.
  6. If you use OAuth in connection with Active Directory Federation Services (ADFS):
    • Check that you have selected the checkbox Skip reading entities from id token under Userinfo URI.
    • Check if the affected employees' email addresses are in the fields "email" or "unique_name" in the authentication provider. Select the appropriate value "on" from the "read email from claim" input.
    • Check if you need to include credentials in the query string. You need to do this for Microsoft Entra ID. You must select the checkbox Include credential in query string under the field Token URI.
  7. Test your configuration by pressing Perform a configuration test.

The integration worked in the past, but employees can't log in

Issue:

The integration worked in the past, but now your employees can't log in.

Possible solution:

There are three main reasons why this may happen:

Your company uses different email domains

Issue:

Your company uses different email domains, such as, .com, .es, or .de.

Possible solution:

Check that the domain you are using matches exactly the one you have entered for the OAuth provider.

Microsoft Entra ID error AADSTS50146

Issue:

You receive the Microsoft Entra ID error: AADSTS50146 (application ID URI configuration).

Possible solution:

Learn how to fix the error: "AADSTS50146: This application is required to be configured with an application ID URI".

Testing your SSO connection

After you set up or change your SSO settings, test the connection to check that it works. Learn how to set up SSO with Microsoft Entra ID, Okta, SAML 2.0, and custom identity providers in our dedicated articles. If you use Okta, select OpenID Connect as your login method.

Follow these steps to test your connection:

  1. Go to Settings.
  2. In the Security & integrations section, click Security & authentication.
  3. Next to your login method, click Configure.
  4. Click Test.
  5. If the test fails, find your error message in the next section.

Fix error messages when you test your SSO connection

When you click Test on an SSO connection and the test fails, Personio usually shows an error message at the bottom left of the screen. This section explains the cause of each message and how to fix it. Most solutions ask you to update the settings on the configuration page you opened to test your connection.

In this section, we cover the following messages:

The email address wasn't found

Issue:

You see this message: "Email was not found". This happens when your identity provider doesn't send an email address for the test user. This message appears for all SSO setups.

Possible solution:

Make sure your identity provider sends the email address, and that Personio reads the right claim.

  1. Check that your identity provider sends an email claim. For SAML, this is an attribute. For OpenID Connect, this is the email scope or claim.
  2. Check that the attribute or claim name in Personio matches exactly what your identity provider sends.
  3. Make sure the test user's email attribute has a value in your identity provider.
  4. Click Test again.

The account isn't linked to a Personio user

Issue:

You see this message: "This account isn't linked to a Personio user yet. Make sure the email address matches an existing employee, then try again." This happens when no employee in Personio has the same email address as the test user. This message appears for all SSO setups.

Possible solution:

Make sure the email address from your identity provider matches an employee record in Personio.

  1. Check that the test user's email address matches an existing employee record in Personio exactly, including the domain and letter case.
  2. If the employee record is missing or the email address is wrong, create the employee or correct the email address.
  3. In your SSO settings in Personio, go to the Claim field and confirm it points to the claim that holds the employee's email address.
  4. Click Test again.

The user's access is pending

Issue:

You see this message: "This user's access is still pending. The user should follow the instructions in the provided email." This happens when the employee hasn't activated their Personio account from the invitation email yet. This message appears for all SSO setups.

Possible solution:

The employee needs to activate their account before the test can succeed.

  1. Ask the person testing the connection to open their invitation email and click the activation link.
  2. Ask the employee to finish creating their account. Their account stays pending until they do.
  3. If they cannot find the email, resend the invitation to Personio from their profile. They can also check their spam or junk folder.
  4. After the account is active, click Test again.

The user isn't allowed to sign in

Issue:

You see this message: "This user isn't allowed to sign in to this company." This happens when the user isn't assigned to the app in your identity provider, or doesn't belong to the correct company in Personio. This message appears for all SSO setups.

Possible solution:

Check the user in both your identity provider and Personio.

  1. In your identity provider, check that the user is assigned to the app. In Microsoft Entra ID, check the user or group assignments of the enterprise application.
  2. In Personio, check that the user belongs to the correct company.

The redirect address isn't registered

Issue:

You see this message: "The redirect address for this connection isn't registered yet. Add your Personio login URL to the allowed callback URLs in your identity provider (or contact support)." This happens when your identity provider doesn't have your Personio callback address on its list of allowed redirect addresses. This message appears for all SSO setups.

Possible solution:

On the configuration page of your login method, copy the callback address:

  1. In your identity provider's app settings, add your Personio callback address to the list of allowed redirect addresses.
  2. Check for typos, missing or extra trailing slashes, and http instead of https.
  3. Save the change and click Test again.
  4. If you see a different message, find it in the list at the start of this section.

The client secret looks incorrect

Issue:

You see this message: "The client secret looks incorrect. Make sure you entered the secret's value, not its ID, from your app registration." This happens when you enter the ID of the secret instead of its value. This message appears for all SSO setups.

Possible solution:

Replace the value in Personio with the secret's value from your identity provider.

  1. In your identity provider's app registration, copy the secret's value, not its ID. In Microsoft Entra ID, go to App registrations > Certificates & secrets.
  2. In your SSO settings in Personio, enter the secret value and save.
  3. Click Test again.

The client secret has expired

Issue:

You see this message: "The client secret for this connection has expired. Generate a new one in app settings and update it here." This happens when the client secret in your identity provider reaches its expiry date. This message appears for all SSO setups.

Possible solution:

Generate a new client secret and update it in Personio.

  1. In your identity provider's app registration, generate a new client secret. In Microsoft Entra ID, go to App registrations > Certificates & secrets.
  2. In your SSO settings in Personio, enter the new secret value and save.
  3. Click Test again.

The issuer doesn't match

Issue:

You see this message: "The identity provider's issuer URL doesn't match what's configured for this connection. Double-check the issuer/authority URL." This happens when the issuer in Personio differs from the issuer your identity provider sends. This message appears for OpenID Connect connections only.

Possible solution:

Copy the issuer from your identity provider's discovery document into Personio.

  1. Open your identity provider's discovery document. Its address ends in /.well-known/openid-configuration. Find the issuer in this document.
  2. In your SSO settings in Personio, compare the Issuer with the one in the discovery document.
  3. Correct any differences, like a wrong tenant ID, a trailing slash, or http instead of https.
  4. Save the change and click Test again.

The SAML signing certificate doesn't match

Issue:

You see this message: "The SAML signing certificate doesn't match. If your identity provider rotated its certificate, upload the new one here." This happens when the certificate in Personio differs from the one your identity provider uses to sign. This message appears for SAML 2.0 connections only.

Possible solution:

Upload the current signing certificate from your identity provider.

  1. Download the current signing certificate from your identity provider's SAML metadata.
  2. In your SSO settings in Personio, upload the certificate.
  3. Make sure the rotation date of the certificate in your identity provider matches the certificate you uploaded.
  4. Click Test again.

The app is set to single-tenant

Issue:

You see this message: "This Microsoft Entra ID app is set to single-tenant. Change it to multi-tenant in your app registration so Personio can sign users in." This happens when the app registration only supports accounts from your own tenant. This message appears for Microsoft Entra ID connections only.

Possible solution:

Change the supported account types of the app registration.

  1. In Microsoft Entra ID, go to App registrations, select your app, and click Authentication.
  2. Under Supported account types, select a multi-tenant option.
  3. Save the change and click Test again.

Sign-in was cancelled before consent

Issue:

You see this message: "Sign-in was cancelled before consent was granted. Try again and accept the permissions request." This happens when the user closes or declines the permissions request from your identity provider. This message appears for all SSO setups.

Possible solution:

Run the test again and accept the permissions request.

  1. Click Test again and accept the permissions request from your identity provider.
  2. If an organization policy blocks the consent screen, ask your identity provider's admin to grant consent for the app.

The connection isn't enabled

Issue:

You see this message: "This connection isn't enabled for the Test Button yet. Please provide a valid configuration and enable it before testing." This happens when the connection is disabled or its configuration isn't valid yet. This message appears for all SSO setups.

Possible solution:

Make sure the connection is enabled and its settings are valid.

  1. Reload the page and check that the connection is enabled. Another browser tab might have disabled it.
  2. If the connection is still disabled, review the configuration steps for your identity provider to make sure the settings are valid.
  3. If the settings are valid and the connection is still disabled, contact Support and share the connection name and your company's Personio hostname. Support can then enable it for you.

Personio couldn't verify the connection

Issue:

You see this message: "We couldn't verify this connection. Check your setup, or contact support if the issue continues." Personio shows this message when the error doesn't match any of the messages above. This message appears for all SSO setups.

Possible solution:

Check each connection setting, then test again.

  1. Check all connection settings: callback address, client ID, client secret, issuer, and certificate.
  2. Click Test again.
  3. If the error continues, contact Support and share the exact error message and the time it appeared.
Help us improve. Is this page helpful?