--- cuppy_hub: aws cuppy_path: reference/identity-center/errors.md cuppy_section: docs cuppy_doc: G3BN-R05V cuppy_doc_uuid: b6752889-1a36-4ad1-aae9-776436f82cd8 cuppy_permalink: https://cuppy.io/aws/d/G3BN-R05V cuppy_version: 4 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/aws/docs/reference/identity-center/errors cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: bfbdbc4175b7f67506277f415bec8b0a8fdba32b75117d82d7b1009ab2d17f7f # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # IAM Identity Center (SSO) errors **Work out where the failure happens first: signing in to the portal (SAML), getting users into Identity Center (SCIM), or the CLI or SDK turning the SSO session into credentials (token).** The fixes don't overlap. The **user lookup** in the Check columns is `aws identitystore list-users --identity-store-id --filters AttributePath=UserName,AttributeValue=` (the identity store ID comes from `aws sso-admin list-instances`). ## Portal and external-IdP sign-in | Message | Cause → fix | Check | |---|---|---| | `An unexpected error has occurred` (after the IdP redirects back) | The SAML assertion doesn't match an Identity Center user. The NameID must be email format, a valid address, and **equal the Identity Center user name**. Users must already exist: there is no just-in-time creation. Or: several assertions, an encrypted assertion, or an ACS URL that doesn't match exactly. With attributes for access control: over 50 attributes, multi-valued or duplicate names, XML values, or a non-SAML name format. CloudTrail: `ExternalIdPDirectoryLogin` | The SAML assertion's NameID (browser SAML tracer) vs the **user lookup** | | `It's not you, it is us` | Setup: device clock off; the IdP certificate in Identity Center differs from the IdP's (re-import under Settings → Identity source); NameID format not `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`; expired AD Connector service-account credentials | Device clock; the two certificates' fingerprints | | `Invalid MFA credentials` | The user signed in before SCIM provisioned them. Check the IdP's provisioning log | The **user lookup** returns nothing yet | | `Session token not found or invalid` | The server revoked or invalidated the session (portal, Toolkit, CLI). Sign in again, and cancel pending Toolkit connection attempts | Does a fresh sign-in work? | | User appears in an assignment but can't access the account | **Deleted and recreated** in the IdP: new internal ID. Remove and redo the assignment | The **user lookup** → `UserId` vs the `PrincipalId` in `aws sso-admin list-account-assignments` | | Users can't sign in with a UPN | With directory MFA in context-aware or always-on mode, sign in as `DOMAIN\UserName` | The sign-in name format the user typed | | `Browser not supported` registering MFA | WebAuthn isn't supported on that browser or platform | Another browser or platform works | | Authenticator-app code rejected (`An unexpected error has occurred`) | Device clock drift (TOTP) | The device's clock vs a time server | | No invitation or verification emails | Allow the senders `no-reply` at `signin.aws` and `no-reply` at `login.awsapps.com` | The mail system's quarantine for those senders | ## SCIM provisioning (seen in the IdP's provisioning log or CloudTrail) | Message | Cause → fix | Check | |---|---|---| | `… Value at 'name.givenName' failed to satisfy constraint: Member must satisfy regular expression pattern …` / `… must have length greater than or equal to 1` | A required attribute is empty. Every user needs a first name, last name, username and display name | The IdP's attribute mapping for that user | | `List attribute emails exceeds allowed limit of 1` / CloudTrail `ValidationException: Currently list attributes only allow single item` | A multi-valued attribute (several emails or phone numbers). Map one value only, or remove the extras | The user's emails or phone numbers in the IdP: more than one? | | `Refused to create a new, duplicate resource` | The username, primary email, `externalId` or group name isn't unique | The **user lookup**, and the same for the email | | Entra ID: `{"schema":[…Error],"detail":"Request is unparsable, syntactically incorrect, or violates schema.","status":"400"}` | Usually the same multi-value problem: check CloudTrail `CreateUser` | CloudTrail `CreateUser` → `errorMessage` | | Entra ID guest users don't sync | `#EXT#` in their UPN. Use a conditional Name ID claim: members → `user.userprincipalname`, guests → `user.mail` | `#EXT#` in the user's UPN | | Entra ID nested-group members missing | Not provisioned by design. Assign the groups that contain users directly | The member's direct groups in Entra ID | | Okta: `Automatic profile push of user … failed: … No user returned for user …` / `Linked group is missing in AWS IAM Identity Center…` | Deleted in Identity Center instead of Okta. Recreate it in Okta; SCIM re-provisions | The **user lookup** returns nothing | | Okta: `Automatic provisioning of user … failed: Matching user not found` | See Okta's article for this error. Usually username matching: match on one attribute (`userName`) only | Okta's provisioning attribute-matching settings | | Sync stopped with no error | The SCIM access token expired (it is valid for one year). Rotate it in Identity Center and update the IdP. Or the October 2026 Identity Store/SCIM network restrictions are blocking the IdP's IP ranges | The token's expiry date under Settings → Identity source → Automatic provisioning | | Users present but group memberships wrong | Membership changed through the Identity Store API: drift SCIM deltas won't correct. Consider an SCP denying `identitystore:Create*`/`Update*`/`Delete*` | `aws identitystore list-group-memberships-for-member` vs the IdP; CloudTrail `CreateGroupMembership` calls not from SCIM | ## CLI and SDK (token → credentials) Messages from the AWS SDK for JavaScript v3. The CLI's wording is similar. **Check for every row:** `aws configure list --profile

`, then read that profile and its `[sso-session]` section in `~/.aws/config`. For `ForbiddenException`, compare `sso_account_id`/`sso_role_name` with the user's assignments. | Message | Cause → fix | |---|---| | `The SSO session associated with this profile has expired. To refresh this SSO session run 'aws sso login' with the corresponding profile.` / `… is invalid. …` / `Token is expired.` | The SSO sign-in, not the role credentials, ended. Run `aws sso login --profile

` (or `--sso-session `). Role credentials refresh automatically only while the SSO session is valid | | `The SSO session token associated with profile=

was not found or is invalid.` | Never logged in on this machine, or `~/.aws/sso/cache` was cleared. Run `aws sso login` | | `Profile

is not configured with SSO credentials.` | The profile has no `sso_session`/`sso_*` keys. Use the right `--profile`, or run `aws configure sso` | | `Profile '

' is missing required property 'sso_session'.` | A profile references SSO without naming its `[sso-session]` section | | `Sso session '' could not be found in shared credentials file.` / `… is missing required property ''.` | `[sso-session ]` is missing from `~/.aws/config`, or lacks `sso_start_url`/`sso_region` | | `Conflicting SSO start_url` | The profile and its `sso-session` give different start URLs. Keep the URL only in `[sso-session]` | | `Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", "sso_region", "sso_role_name", "sso_start_url"…` | A legacy-style profile is missing keys. Migrate to `sso-session` | | `ForbiddenException` / `UnauthorizedException` from `GetRoleCredentials` | The user no longer has that account and role assigned, or `sso_role_name` is wrong (UNVERIFIED exception names in the collected sources) | | PKCE login URL won't complete on a remote host | PKCE (the default from CLI 2.22.0) must finish in a browser on the same device. Use `aws sso login --use-device-code` | ## Administration | Message | Cause → fix | Check | |---|---|---| | `Cannot perform the operation on the protected role 'AWSReservedSSO_…' - this role is only modifiable by AWS` | Edit the **permission set** in Identity Center (management account or delegated admin), not the role in IAM | The role name starts with `AWSReservedSSO_` | | `You cannot delete/modify/remove/assign access to permission sets provisioned in the management account` | Delegated administrators can't manage permission sets provisioned in the management account. Use a management-account principal | `aws sts get-caller-identity`: is the caller in the management account? | | `Attributes for access control failed to enable` | The caller lacks `iam:UpdateAssumeRolePolicy` | `aws iam simulate-principal-policy --policy-source-arn --action-names iam:UpdateAssumeRolePolicy` | | `sso-admin` `ConflictException` | An earlier write hasn't propagated. Retry with backoff | A retry after a few seconds succeeds | | Permission set changed but accounts still have the old policy | API or IaC edits aren't pushed. Call `ProvisionPermissionSet` | `aws sso-admin list-accounts-for-provisioned-permission-set --instance-arn --permission-set-arn --provisioning-status LATEST_PERMISSION_SET_NOT_PROVISIONED` | | Can't create an account instance | One instance per account (check other Regions); account instances must be enabled for organizations that enabled Identity Center before 2023-09-14; an SCP may block it | `aws sso-admin list-instances` in each Region | | KMS key policy or EKS `aws-auth` lost access after reassigning | The role ARN suffix changed (`reference/identity-center/provisioned-roles-and-sessions.md`) | Compare the ARN in the policy with `aws iam list-roles --path-prefix /aws-reserved/sso.amazonaws.com/` | ## When none of these fits Find the failing sign-in or provisioning event in CloudTrail (Identity Center events carry `userIdentity.type` `IdentityCenterUser` and `onBehalfOf`, `reference/cloudtrail/event-records.md`). Compare what the IdP sent (NameID, SCIM user, group membership) with the Identity Center user. Re-run the permission set provisioning and read its status. Keep the IdP's SAML response or SCIM log for the case. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 131 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/aws/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.