{"record":{"id":"e45951ac3eef1273","repo":"bitwarden/server","slug":"an-organization-the-user-is-a-part-of-has-enabled","errorCode":null,"errorMessage":"An organization the user is a part of has enabled Automatic User Confirmation policy, and it does not support the user joining a provider.","messagePattern":"An organization the user is a part of has enabled Automatic User Confirmation policy, and it does not support the user joining a provider\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs","lineNumber":135,"sourceCode":"        if (!CoreHelpers.TokenIsValid(\"ProviderSetupInvite\", _dataProtector, token, owner.Email, provider.Id,\n            _globalSettings.OrganizationInviteExpirationHours))\n        {\n            throw new BadRequestException(\"Invalid token.\");\n        }\n\n        var providerUser = await _providerUserRepository.GetByProviderUserAsync(provider.Id, ownerUserId);\n        if (!(providerUser is { Type: ProviderUserType.ProviderAdmin }))\n        {\n            throw new BadRequestException(\"Invalid owner.\");\n        }\n\n        var organizationAutoConfirmPolicyRequirement = await _policyRequirementQuery\n            .GetAsync<AutomaticUserConfirmationPolicyRequirement>(ownerUserId);\n\n        if (organizationAutoConfirmPolicyRequirement\n            .CannotCreateProvider())\n        {\n            throw new BadRequestException(new UserCannotJoinProvider().Message);\n        }\n\n        var customer = await _providerBillingService.SetupCustomer(provider, paymentMethod, billingAddress);\n        provider.GatewayCustomerId = customer.Id;\n        var subscription = await _providerBillingService.SetupSubscription(provider);\n        provider.GatewaySubscriptionId = subscription.Id;\n        provider.Status = ProviderStatusType.Billable;\n        await _providerRepository.UpsertAsync(provider);\n\n        providerUser.Key = key;\n        await _providerUserRepository.ReplaceAsync(providerUser);\n\n        return provider;\n    }\n\n    public async Task UpdateAsync(Provider provider, bool updateBilling = false)\n    {\n        if (provider.Id == default)","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs#L117-L153","documentation":"Thrown inside CompleteSetupAsync when the completing user belongs to an organization that has the Automatic User Confirmation (SSO trust) policy enabled, which is incompatible with creating/joining a provider. Checked via AutomaticUserConfirmationPolicyRequirement.CannotCreateProvider(). BadRequestException (HTTP 400); message from UserCannotJoinProvider.","triggerScenarios":"The owner is a member of an org enforcing automatic user confirmation; attempting to complete provider setup under that constraint.","commonSituations":"Enterprise SSO-managed users trying to set up an MSP provider; the policy was enabled on their org after the invite was sent.","solutions":["Use a provider owner who is not subject to the automatic confirmation policy.","Have an org admin disable/adjust the conflicting policy for that user's organizations.","Pre-check CannotCreateProvider() and surface the policy conflict before setup."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"var req = await _policyRequirementQuery.GetAsync<AutomaticUserConfirmationPolicyRequirement>(ownerUserId);\nif (req.CannotCreateProvider())\n    throw new InvalidOperationException(\"Owner is subject to an Automatic User Confirmation policy that blocks provider creation.\");","typeGuard":null,"tryCatchPattern":"try { await _providerService.CompleteSetupAsync(provider, ownerUserId, token, key, payment, billing); }\ncatch (BadRequestException ex) when (ex.Message.Contains(\"Automatic User Confirmation\"))\n{ /* pick a different owner or adjust the org policy */ }","preventionTips":["Choose an owner not enrolled in SSO auto-confirmation.","Pre-check CannotCreateProvider() and warn before setup.","Coordinate with org admins before enabling the conflicting policy."],"tags":["provider","policy","sso","setup","authorization","bitwarden"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}