IAM Identity Center (SSO) errors
Look up an SSO failure by its message — AWS access portal and external-IdP sign-in errors, SCIM provisioning errors from Okta, Entra ID and others, CLI and SDK token errors (expired or missing SSO session, profile misconfiguration), protected AWSReservedSSO roles, and the sso-admin API — each with cause and fix.
markdownreferencev4G3BN-R05Vstage: operatetrust: officialservice: identity-centerinterface: anyAn unexpected error has occurredIt's not you it is usInvalid MFA credentialsSession token not found or invalidThe SSO session associated with this profile has expiredToken is expiredis missing required property 'sso_session'could not be found in shared credentials fileConflicting SSO start_urlCannot perform the operation on the protected roleAWSReservedSSORefused to create a new duplicate resourceList attribute emails exceeds allowed limit of 1Currently list attributes only allow single itemfailed to satisfy constraint name.givenNameMatching user not foundLinked group is missingSCIM 400ConflictExceptionProvisionPermissionSet
Work out where the failure happens first: signing in to the portal (SAML), getting users into Identity Center (SCIM), or the CLI or SDK turning the SSO session into credentials (token). The fixes don't overlap.
The user lookup in the Check columns is aws identitystore list-users --identity-store-id <id> --filters AttributePath=UserName,AttributeValue=<u> (the identity store ID comes from aws sso-admin list-instances).
Portal and external-IdP sign-in
| Message | Cause → fix | Check |
|---|---|---|
An unexpected error has occurred (after the IdP redirects back) | The SAML assertion doesn't match an Identity Center user. The NameID must be email format, a valid address, and equal the Identity Center user name. Users must already exist: there is no just-in-time creation. Or: several assertions, an encrypted assertion, or an ACS URL that doesn't match exactly. With attributes for access control: over 50 attributes, multi-valued or duplicate names, XML values, or a non-SAML name format. CloudTrail: ExternalIdPDirectoryLogin | The SAML assertion's NameID (browser SAML tracer) vs the user lookup |
It's not you, it is us | Setup: device clock off; the IdP certificate in Identity Center differs from the IdP's (re-import under Settings → Identity source); NameID format not urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress; expired AD Connector service-account credentials | Device clock; the two certificates' fingerprints |
Invalid MFA credentials | The user signed in before SCIM provisioned them. Check the IdP's provisioning log | The user lookup returns nothing yet |
Session token not found or invalid | The server revoked or invalidated the session (portal, Toolkit, CLI). Sign in again, and cancel pending Toolkit connection attempts | Does a fresh sign-in work? |
| User appears in an assignment but can't access the account | Deleted and recreated in the IdP: new internal ID. Remove and redo the assignment | The user lookup → UserId vs the PrincipalId in aws sso-admin list-account-assignments |
| Users can't sign in with a UPN | With directory MFA in context-aware or always-on mode, sign in as DOMAIN\UserName | The sign-in name format the user typed |
Browser not supported registering MFA | WebAuthn isn't supported on that browser or platform | Another browser or platform works |
Authenticator-app code rejected (An unexpected error has occurred) | Device clock drift (TOTP) | The device's clock vs a time server |
| No invitation or verification emails | Allow the senders no-reply at signin.aws and no-reply at login.awsapps.com | The mail system's quarantine for those senders |
SCIM provisioning (seen in the IdP's provisioning log or CloudTrail)
| Message | Cause → fix | Check |
|---|---|---|
… Value at 'name.givenName' failed to satisfy constraint: Member must satisfy regular expression pattern … / … must have length greater than or equal to 1 | A required attribute is empty. Every user needs a first name, last name, username and display name | The IdP's attribute mapping for that user |
List attribute emails exceeds allowed limit of 1 / CloudTrail ValidationException: Currently list attributes only allow single item | A multi-valued attribute (several emails or phone numbers). Map one value only, or remove the extras | The user's emails or phone numbers in the IdP: more than one? |
Refused to create a new, duplicate resource | The username, primary email, externalId or group name isn't unique | The user lookup, and the same for the email |
Entra ID: {"schema":[…Error],"detail":"Request is unparsable, syntactically incorrect, or violates schema.","status":"400"} | Usually the same multi-value problem: check CloudTrail CreateUser | CloudTrail CreateUser → errorMessage |
| Entra ID guest users don't sync | #EXT# in their UPN. Use a conditional Name ID claim: members → user.userprincipalname, guests → user.mail | #EXT# in the user's UPN |
| Entra ID nested-group members missing | Not provisioned by design. Assign the groups that contain users directly | The member's direct groups in Entra ID |
Okta: Automatic profile push of user … failed: … No user returned for user … / Linked group is missing in AWS IAM Identity Center… | Deleted in Identity Center instead of Okta. Recreate it in Okta; SCIM re-provisions | The user lookup returns nothing |
Okta: Automatic provisioning of user … failed: Matching user not found | See Okta's article for this error. Usually username matching: match on one attribute (userName) only | Okta's provisioning attribute-matching settings |
| Sync stopped with no error | The SCIM access token expired (it is valid for one year). Rotate it in Identity Center and update the IdP. Or the October 2026 Identity Store/SCIM network restrictions are blocking the IdP's IP ranges | The token's expiry date under Settings → Identity source → Automatic provisioning |
| Users present but group memberships wrong | Membership changed through the Identity Store API: drift SCIM deltas won't correct. Consider an SCP denying identitystore:Create*/Update*/Delete* | aws identitystore list-group-memberships-for-member vs the IdP; CloudTrail CreateGroupMembership calls not from SCIM |
CLI and SDK (token → credentials)
Messages from the AWS SDK for JavaScript v3. The CLI's wording is similar.
Check for every row: aws configure list --profile <p>, then read that profile and its [sso-session] section in ~/.aws/config. For ForbiddenException, compare sso_account_id/sso_role_name with the user's assignments.
| Message | Cause → fix |
|---|---|
The SSO session associated with this profile has expired. To refresh this SSO session run 'aws sso login' with the corresponding profile. / … is invalid. … / Token is expired. | The SSO sign-in, not the role credentials, ended. Run aws sso login --profile <p> (or --sso-session <s>). Role credentials refresh automatically only while the SSO session is valid |
The SSO session token associated with profile=<p> was not found or is invalid. | Never logged in on this machine, or ~/.aws/sso/cache was cleared. Run aws sso login |
Profile <p> is not configured with SSO credentials. | The profile has no sso_session/sso_* keys. Use the right --profile, or run aws configure sso |
Profile '<p>' is missing required property 'sso_session'. | A profile references SSO without naming its [sso-session] section |
Sso session '<s>' could not be found in shared credentials file. / … is missing required property '<k>'. | [sso-session <s>] is missing from ~/.aws/config, or lacks sso_start_url/sso_region |
Conflicting SSO start_url | The profile and its sso-session give different start URLs. Keep the URL only in [sso-session] |
Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", "sso_region", "sso_role_name", "sso_start_url"… | A legacy-style profile is missing keys. Migrate to sso-session |
ForbiddenException / UnauthorizedException from GetRoleCredentials | The user no longer has that account and role assigned, or sso_role_name is wrong (UNVERIFIED exception names in the collected sources) |
| PKCE login URL won't complete on a remote host | PKCE (the default from CLI 2.22.0) must finish in a browser on the same device. Use aws sso login --use-device-code |
Administration
| Message | Cause → fix | Check |
|---|---|---|
Cannot perform the operation on the protected role 'AWSReservedSSO_…' - this role is only modifiable by AWS | Edit the permission set in Identity Center (management account or delegated admin), not the role in IAM | The role name starts with AWSReservedSSO_ |
You cannot delete/modify/remove/assign access to permission sets provisioned in the management account | Delegated administrators can't manage permission sets provisioned in the management account. Use a management-account principal | aws sts get-caller-identity: is the caller in the management account? |
Attributes for access control failed to enable | The caller lacks iam:UpdateAssumeRolePolicy | aws iam simulate-principal-policy --policy-source-arn <caller> --action-names iam:UpdateAssumeRolePolicy |
sso-admin ConflictException | An earlier write hasn't propagated. Retry with backoff | A retry after a few seconds succeeds |
| Permission set changed but accounts still have the old policy | API or IaC edits aren't pushed. Call ProvisionPermissionSet | aws sso-admin list-accounts-for-provisioned-permission-set --instance-arn <i> --permission-set-arn <ps> --provisioning-status LATEST_PERMISSION_SET_NOT_PROVISIONED |
| Can't create an account instance | One instance per account (check other Regions); account instances must be enabled for organizations that enabled Identity Center before 2023-09-14; an SCP may block it | aws sso-admin list-instances in each Region |
KMS key policy or EKS aws-auth lost access after reassigning | The role ARN suffix changed (reference/identity-center/provisioned-roles-and-sessions.md) | Compare the ARN in the policy with aws iam list-roles --path-prefix /aws-reserved/sso.amazonaws.com/ |
When none of these fits
Find the failing sign-in or provisioning event in CloudTrail (Identity Center events carry userIdentity.type IdentityCenterUser and onBehalfOf, reference/cloudtrail/event-records.md). Compare what the IdP sent (NameID, SCIM user, group membership) with the Identity Center user. Re-run the permission set provisioning and read its status. Keep the IdP's SAML response or SCIM log for the case.