bitwarden/server · error · BadRequestException

An organization the user is a part of has enabled Automatic

Error message

An organization the user is a part of has enabled Automatic User Confirmation policy, and it does not support the user joining a provider.

What it means

Thrown inside CompleteSetupAsync when the completing user belongs to an organization that has the Automatic User Confirmation (SSO trust) policy enabled, which is incompatible with creating/joining a provider. Checked via AutomaticUserConfirmationPolicyRequirement.CannotCreateProvider(). BadRequestException (HTTP 400); message from UserCannotJoinProvider.

Source

Thrown at bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs:135

        if (!CoreHelpers.TokenIsValid("ProviderSetupInvite", _dataProtector, token, owner.Email, provider.Id,
            _globalSettings.OrganizationInviteExpirationHours))
        {
            throw new BadRequestException("Invalid token.");
        }

        var providerUser = await _providerUserRepository.GetByProviderUserAsync(provider.Id, ownerUserId);
        if (!(providerUser is { Type: ProviderUserType.ProviderAdmin }))
        {
            throw new BadRequestException("Invalid owner.");
        }

        var organizationAutoConfirmPolicyRequirement = await _policyRequirementQuery
            .GetAsync<AutomaticUserConfirmationPolicyRequirement>(ownerUserId);

        if (organizationAutoConfirmPolicyRequirement
            .CannotCreateProvider())
        {
            throw new BadRequestException(new UserCannotJoinProvider().Message);
        }

        var customer = await _providerBillingService.SetupCustomer(provider, paymentMethod, billingAddress);
        provider.GatewayCustomerId = customer.Id;
        var subscription = await _providerBillingService.SetupSubscription(provider);
        provider.GatewaySubscriptionId = subscription.Id;
        provider.Status = ProviderStatusType.Billable;
        await _providerRepository.UpsertAsync(provider);

        providerUser.Key = key;
        await _providerUserRepository.ReplaceAsync(providerUser);

        return provider;
    }

    public async Task UpdateAsync(Provider provider, bool updateBilling = false)
    {
        if (provider.Id == default)

View on GitHub (pinned to e93b962371)

Solutions

1. Use a provider owner who is not subject to the automatic confirmation policy.
2. Have an org admin disable/adjust the conflicting policy for that user's organizations.
3. Pre-check CannotCreateProvider() and surface the policy conflict before setup.

var req = await _policyRequirementQuery.GetAsync<AutomaticUserConfirmationPolicyRequirement>(ownerUserId);
if (req.CannotCreateProvider())
    throw new InvalidOperationException("Owner is subject to an Automatic User Confirmation policy that blocks provider creation.");

try { await _providerService.CompleteSetupAsync(provider, ownerUserId, token, key, payment, billing); }
catch (BadRequestException ex) when (ex.Message.Contains("Automatic User Confirmation"))
{ /* pick a different owner or adjust the org policy */ }

When it happens

Trigger: The owner is a member of an org enforcing automatic user confirmation; attempting to complete provider setup under that constraint.

Common situations: Enterprise SSO-managed users trying to set up an MSP provider; the policy was enabled on their org after the invite was sent.

Related errors

• Invalid owner.
• Provider is already setup.
• Invalid token.
• Invalid permissions.
• Invalid owner. Owner must be an existing Bitwarden user.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/e45951ac3eef1273. Report an issue: GitHub.