Skip to main content

Find the answers you need

Troubleshoot: SSO login issues

This article provides troubleshooting steps for Google SSO and OAuth 2.0 providers like Microsoft Entra ID and Okta.

Before you start

  • If you use SSO via OpenID Connect / OAuth 2.0:
    • If you can’t log in, it might be because your client secret has expired. When your client secret expires, Personio emails your Account Owner a recovery link and instructions. Before attempting further solutions, ask them to check their email account. They need to follow the link in the email to authenticate using email and password. They can then access Personio and update the secret. The token expires after three days.
  • If you’re not experiencing the issue above, try the following:
    • Use a different browser.
    • Clear your browser cache.
    • Use incognito mode.
    • Log out and make sure you log in with the correct credentials.
    • Create a new profile on your browser of choice.
    • Disable extensions.
    • Read the frequently asked questions on SSO
  • If SSO works on desktop but not in the mobile app, the problem is usually device-related and not a configuration issue. Troubleshoot mobile app login issues.

Google SSO issues

If Then

You receive this error message: 

"Could not find employee for Google login"

Try the following steps:
 

  1. Log out from Google.
  2. Log into Personio. When Google asks you to select your account, make sure to select the correct one.
Your company changes its email domain If your company changes its email domain, Personio doesn't recognize the email addresses anymore, and employees can't log in.
The integration worked in the past, but now your employees can’t log in Your company might have changed its email domain.

 

OpenID Connect / OAuth 2.0 (including Microsoft Entra ID and Okta) issues

If Then
An employee (or group of employees) can’t log in

Try the following steps:
 

  1. Go to the People List and filter for those affected.
  2. Check that the employees’ email addresses are correct.
  3. If the above doesn’t work, check if the email addresses in Personio and the OAuth provider match.
Your employees can’t log in after the initial setup

 

Try the following steps:

  1. Go to Settings. 
  2. In the Security & integrations section, click Security & authentication. 
  3. From the list of login methods, go to OpenID Connect (OIDC) and click Configure. 

Check the settings you have in place for your identity provider:

  • Check that Scopes is set to “openid,email”. Different scopes might be necessary depending on the identity provider. Check the required scopes.
  • If you have a custom identity provider, add it.
  • Check the Authorization URI.
  • Check the Token URI.
  • Check if the Callback URI is correctly set in the identity provider.
  • Check that the Issuer and JSON Web Key Sets (JWKs) URIs are set.
  • Check the expiry date of the client secret. Note that if your client secret expires, Personio emails your Account Owner with steps to regain access to Personio.
  • In the Claim field, confirm that the employee email address is the same as the email address stored in Personio.

We also recommend you do the following:

  • Make sure you’ve already invited your employees to Personio. They each need to activate their account before they can log in.
  • For the employees who can’t log in, check whether they’re from a different tenant or are guest users that sync from the tenant and have a different issuer in the token. In this case, it’s best to use the Microsoft Entra ID connection.

If you use OAuth in connection with Active Directory Federation Services (ADFS):

  • Check that you have selected the checkbox Skip reading entities from id token under Userinfo URI.
  • Check if the affected employees’ email addresses are in the fields “email” or “unique_name” in the authentication provider. Select the appropriate value “on” from the "read email from claim" input.
  • Check if you need to include credentials in the query string. You need to do this for Microsoft Entra ID. You must select the checkbox Include credential in query string under the field Token URI.
  • Test your configuration by pressing Perform a configuration test.
The integration worked in the past, but now your employees can’t log in

There are three main reasons why this may happen:
Your company uses different email domains, such as, .com, .es, or .de Check that the domain you are using matches exactly the one you have entered for the OAuth provider.
You receive the Microsoft Entra ID error: AADSTS50146 (application ID URI configuration) Learn how to fix the error: "AADSTS50146: This application is required to be configured with an application ID URI".
Help us improve. Is this page helpful?