> ## Documentation Index
> Fetch the complete documentation index at: https://www.voiceflow.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshoot SSO

> Determine whether the problem is opening settings, saving configuration, reaching your identity provider, returning to Voiceflow, or accessing a workspace.

## Identify where sign-in fails

Determine whether the problem is opening settings, saving configuration, reaching your identity provider, returning to Voiceflow, or accessing a workspace. Keep any working administrator session open. Record the time and exact error before making changes.

## Choose the symptom

<a id="check-the-failing-stage"></a>

<Accordion title="SSO settings are missing or saving is unauthorized">

Confirm that the organization is on Enterprise and that you have organization administrator access. Workspace administrator access alone is not enough. Contact your Customer Success representative to confirm the organization and permissions if the page is missing or saving fails with an authorization error.

</Accordion>

<Accordion title="Saving reports Invalid SAML configuration">

Check the provider’s entity identifier and sign-in URL with your identity-provider administrator. Confirm that the certificate is complete, correctly formatted, and unexpired. Recheck the saved values: validation runs after persistence, so a failed save does not guarantee rollback. If the problem remains, contact Voiceflow before further changes.

</Accordion>

<Accordion title="Your email does not route to the identity provider">

Check the work email domain you entered. Ask Voiceflow to confirm that the domain is registered to the intended organization. Newly renamed domains need to be added by Voiceflow; assigning a user to an application or workspace does not register their domain.

</Accordion>

<Accordion title="The provider rejects access or Voiceflow rejects the response">

Have your identity-provider administrator check application assignment, the audience, the exact callback URL, the signing certificate, and the email identifier. Use the [settings reference](/docs/documentation/account-management/sso/settings). For a legacy connection, confirm the callback with Voiceflow before replacing it. An expired certificate or mismatched audience can prevent authentication even when the provider login succeeds.

</Accordion>

<Accordion title="You see User already exists">

The account may already be associated with a different SAML provider. Contact Voiceflow to review the account association and migration. Do not delete the account or use another email to work around the conflict.

</Accordion>

<Accordion title="Sign-in succeeds but the workspace is missing">

Confirm that you used the email belonging to the intended Voiceflow account. Ask your administrator to check organization membership, workspace access, and role. Successful authentication does not grant all workspaces. Contact Voiceflow if an existing account needs migration into the organization.

</Accordion>

<Accordion title="No administrator can sign in">

Contact your Voiceflow Customer Success representative for access recovery. Describe the last configuration, certificate, or domain change and whether anyone still has an active administrator session. Do not assume that a normal password reset can recover an SSO account.

</Accordion>

## Verify the fix

Repeat the original sign-in in a separate browser session. Confirm both the return to Voiceflow and access to the intended workspace. After a certificate or domain change, test an affected user and a user whose access should remain unchanged before closing the working administrator session.

## What to share with Voiceflow

Provide your organization or workspace name, affected email domain, identity-provider name, timestamp and time zone, exact error, last relevant change, and whether the problem affects new or existing accounts. Include whether it occurs from the Voiceflow login page or the provider’s application launcher. Use your established support channel. Never send passwords, private keys, session tokens, or raw SAML responses in an ordinary support message.