{"record":{"id":"7c5258f0fc835911","repo":"gravitational/teleport","slug":"app-does-not-have-sso-set-up","errorCode":null,"errorMessage":"app does not have SSO set up","messagePattern":"app does not have SSO set up","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/integrations/azureoidc/accessgraph.go","lineNumber":37,"sourceCode":"import (\n\t\"bytes\"\n\t\"compress/gzip\"\n\t\"context\"\n\t\"encoding/json\"\n\t\"errors\"\n\t\"io\"\n\t\"log/slog\"\n\t\"os\"\n\t\"path\"\n\n\t\"github.com/gravitational/trace\"\n\n\t\"github.com/gravitational/teleport/api/types\"\n\t\"github.com/gravitational/teleport/lib/msgraph\"\n\t\"github.com/gravitational/teleport/lib/msgraph/models\"\n)\n\nvar errNonSSOApp = errors.New(\"app does not have SSO set up\")\n\n// singleSignOnMode represents the possible values for `currentSingleSignOnMode` in `adSingleSignOn`\ntype singleSignOnMode string\n\nconst (\n\t// singleSignOnModeNone indicates that the application does not have SSO set up.\n\tsingleSignOnModeNone singleSignOnMode = \"none\" //nolint:unused // this serves as documentation of a possible value.\n\t// singleSignOnModeFederated indicates federated SSO such as SAML.\n\tsingleSignOnModeFederated singleSignOnMode = \"federated\"\n)\n\n// adSingleSignOn represents the response from https://main.iam.ad.ext.azure.com/api/ApplicationSso/{servicePrincipalID}/SingleSignOn\ntype adSingleSignOn struct {\n\tCurrentSingleSignOnMode singleSignOnMode `json:\"currentSingleSignOnMode\"`\n}\n\n// TAGInfoCache is the format for the file produced by CreateTAGCacheFile.\ntype TAGInfoCache struct {","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/integrations/azureoidc/accessgraph.go#L19-L55","documentation":"Sentinel errNonSSOApp returned when fetching an Azure AD (Entra) enterprise application's single-sign-on settings succeeds but currentSingleSignOnMode is not 'federated'; the app was created without federated SSO configured, so its SAML metadata cannot be retrieved. Callers like the Access Graph ingest treat it as a signal to skip the app.","triggerScenarios":"Thrown at lib/integrations/azureoidc/accessgraph.go:37 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure federated SSO (SAML) on the Azure enterprise application so currentSingleSignOnMode becomes federated","If the app is expected to be skipped, no action is needed — it is logged at debug and skipped"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}