> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloud.cdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra ID SSO Troubleshooting

> Common questions and issues when configuring Microsoft Entra ID as your SSO provider for Connect AI, with suggested solutions.

<Note>
  Connect AI uses Auth0 as its managed identity broker. Any step that refers to the Auth0 tenant, domain, plan, or Rules and Actions is configured by CData on the broker side. If one applies to your issue, contact [CData Support](https://www.cdata.com/support/submit.aspx). The remaining steps are configured in your own identity provider.
</Note>

## Frequently Asked Questions

<AccordionGroup>
  <Accordion title="Which scopes should I request?">
    Use `openid email profile`. Only `openid` is mandatory; add others, like `offline_access`, solely when your scenario calls for refresh tokens.
  </Accordion>

  <Accordion title="Can we restrict who can log in?">
    Yes. On your side, enable **User assignment required** in Entra ID and assign only the intended users or groups. Additional filtering by email, domain, or group via Auth0 Actions or Rules is configured by CData on the broker side; contact [CData Support](https://www.cdata.com/support/submit.aspx) if you need it.
  </Accordion>
</AccordionGroup>

## Common Errors

<AccordionGroup>
  <Accordion title="The connection returns a non-specific error.">
    * A mismatched endpoint is the most likely cause. The common endpoint ([https://login.microsoftonline.com/common](https://login.microsoftonline.com/common)) only requires your email domain. A tenant-specific endpoint ([https://login.microsoftonline.com/companyname.com](https://login.microsoftonline.com/companyname.com)) additionally requires a client ID and client secret, so double-check that both are entered correctly.
    * Make sure the redirect URI registered in Entra ID exactly matches the broker's callback URL (ends in `/login/callback`). CData provides the exact value when SSO is enabled.
    * Confirm the tenant ID is correct in all URLs.
  </Accordion>

  <Accordion title="An 'option validation failed' error is returned.">
    A malformed URL is the usual cause. When you supply your Entra endpoints, use the v2.0 versions, with no trailing slashes and no query parameters such as `?scope=...` in the URL. The connection strategy itself (OIDC versus SAML) is selected by CData on the broker side, so if the URLs look correct, contact [CData Support](https://www.cdata.com/support/submit.aspx).
  </Accordion>

  <Accordion title="A 403 is returned or the connection fails to save.">
    Both common causes here are on the broker side that CData manages:

    * The connection may need to use the default Auth0 domain rather than a custom one.
    * The Auth0 plan must support Enterprise (SSO) connections.

    Contact [CData Support](https://www.cdata.com/support/submit.aspx) to check these.
  </Accordion>
</AccordionGroup>

To enable SSO for your account or for additional help, contact [CData Support](https://www.cdata.com/support/submit.aspx).