bitwarden/server · error · BadRequestException

Business Unit Providers cannot manage organizations with the

Error message

Business Unit Providers cannot manage organizations with the plan type {requestedType}. Only Enterprise (Monthly) and Enterprise (Annually) are allowed.

What it means

Thrown by ProviderService.ThrowOnInvalidPlanType for a BusinessUnit provider when the requested PlanType is not EnterpriseMonthly or EnterpriseAnnually. Business Unit providers can only manage Enterprise-tier organizations. BadRequestException (HTTP 400).

Source

Thrown at bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs:748

        var confirmedOwners = providerAdmins.Where(o => o.Status == ProviderUserStatusType.Confirmed);
        var confirmedOwnersIds = confirmedOwners.Select(u => u.Id);
        return confirmedOwnersIds.Except(providerUserIds).Any();
    }

    private void ThrowOnInvalidPlanType(ProviderType providerType, PlanType requestedType)
    {
        switch (providerType)
        {
            case ProviderType.Msp:
                if (requestedType is not (PlanType.TeamsMonthly or PlanType.EnterpriseMonthly))
                {
                    throw new BadRequestException($"Managed Service Providers cannot manage organizations with the plan type {requestedType}. Only Teams (Monthly) and Enterprise (Monthly) are allowed.");
                }
                break;
            case ProviderType.BusinessUnit:
                if (requestedType is not (PlanType.EnterpriseMonthly or PlanType.EnterpriseAnnually))
                {
                    throw new BadRequestException($"Business Unit Providers cannot manage organizations with the plan type {requestedType}. Only Enterprise (Monthly) and Enterprise (Annually) are allowed.");
                }
                break;
            case ProviderType.Reseller:
                if (_resellerDisallowedOrganizationTypes.Contains(requestedType))
                {
                    throw new BadRequestException($"Providers cannot manage organizations with the requested plan type ({requestedType}). Only Teams and Enterprise accounts are allowed.");
                }
                break;
            default:
                throw new BadRequestException($"Unsupported provider type {providerType}.");
        }
    }

    private async Task UpdateClientOrganizationsEnabledStatusAsync(Guid providerId, bool enabled)
    {
        var providerOrganizations = await _providerOrganizationRepository.GetManyDetailsByProviderAsync(providerId);

        foreach (var providerOrganization in providerOrganizations)

View on GitHub (pinned to e93b962371)

Solutions

1. Upgrade the organization to an Enterprise plan (monthly or annual) before assigning to a BusinessUnit provider.
2. For non-Enterprise orgs, use the appropriate MSP or Reseller flow instead.
3. Validate PlanType is in the Enterprise set before calling AddOrganization.

Example fix

// before
await providerService.AddOrganization(buProviderId, orgId, key);

// after
var allowed = new[] { PlanType.EnterpriseMonthly, PlanType.EnterpriseAnnually };
if (!allowed.Contains(org.PlanType))
{
    return BadRequest("Org must be Enterprise (Monthly or Annual) for a Business Unit provider.");
}
await providerService.AddOrganization(buProviderId, orgId, key);

var allowed = new[] { PlanType.EnterpriseMonthly, PlanType.EnterpriseAnnually };
if (!allowed.Contains(org.PlanType)) return BadRequest("Enterprise only.");

static bool BusinessUnitAllows(PlanType t) => t is PlanType.EnterpriseMonthly or PlanType.EnterpriseAnnually;

When it happens

Trigger: Assigning a non-Enterprise organization (Free, Families, Teams, Starter) to a BusinessUnit provider.

Common situations: Trying to put a Teams-tier org under a business-unit provider; converting a non-enterprise org through the business-unit flow.

Related errors

• Managed Service Providers cannot manage organizations with t
• Providers cannot manage organizations with the requested pla
• The organization is subscribed to Secrets Manager. Please co
• Provider plan not found.
• Failed to remove organization vault. Please contact support.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/801e020ef78add62. Report an issue: GitHub.