bitwarden/server · error · BadRequestException

Managed Service Providers cannot manage organizations with t

Error message

Managed Service Providers cannot manage organizations with the plan type {requestedType}. Only Teams (Monthly) and Enterprise (Monthly) are allowed.

What it means

Thrown by ProviderService.ThrowOnInvalidPlanType for an Msp provider when the requested organization PlanType is not TeamsMonthly or EnterpriseMonthly. MSPs may only manage Teams (Monthly) and Enterprise (Monthly) organizations. BadRequestException (HTTP 400).

Source

Thrown at bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs:742

    }

    private async Task<bool> HasConfirmedProviderAdminExceptAsync(Guid providerId, IEnumerable<Guid> providerUserIds)
    {
        var providerAdmins = await _providerUserRepository.GetManyByProviderAsync(providerId,
            ProviderUserType.ProviderAdmin);
        var confirmedOwners = providerAdmins.Where(o => o.Status == ProviderUserStatusType.Confirmed);
        var confirmedOwnersIds = confirmedOwners.Select(u => u.Id);
        return confirmedOwnersIds.Except(providerUserIds).Any();
    }

    private void ThrowOnInvalidPlanType(ProviderType providerType, PlanType requestedType)
    {
        switch (providerType)
        {
            case ProviderType.Msp:
                if (requestedType is not (PlanType.TeamsMonthly or PlanType.EnterpriseMonthly))
                {
                    throw new BadRequestException($"Managed Service Providers cannot manage organizations with the plan type {requestedType}. Only Teams (Monthly) and Enterprise (Monthly) are allowed.");
                }
                break;
            case ProviderType.BusinessUnit:
                if (requestedType is not (PlanType.EnterpriseMonthly or PlanType.EnterpriseAnnually))
                {
                    throw new BadRequestException($"Business Unit Providers cannot manage organizations with the plan type {requestedType}. Only Enterprise (Monthly) and Enterprise (Annually) are allowed.");
                }
                break;
            case ProviderType.Reseller:
                if (_resellerDisallowedOrganizationTypes.Contains(requestedType))
                {
                    throw new BadRequestException($"Providers cannot manage organizations with the requested plan type ({requestedType}). Only Teams and Enterprise accounts are allowed.");
                }
                break;
            default:
                throw new BadRequestException($"Unsupported provider type {providerType}.");
        }
    }

View on GitHub (pinned to e93b962371)

Solutions

1. Convert the organization's plan to TeamsMonthly or EnterpriseMonthly before adding it to the MSP.
2. Validate requestedType against the MSP-allowed set client-side and block the add.
3. For annual plans, use a BusinessUnit or Reseller provider, or change the org to monthly.

Example fix

// before
await providerService.AddOrganization(mspProviderId, orgId, key);

// after
var allowed = new[] { PlanType.TeamsMonthly, PlanType.EnterpriseMonthly };
if (!allowed.Contains(org.PlanType))
{
    return BadRequest("Switch the org to a Monthly Teams/Enterprise plan first.");
}
await providerService.AddOrganization(mspProviderId, orgId, key);

var allowed = new[] { PlanType.TeamsMonthly, PlanType.EnterpriseMonthly };
if (!allowed.Contains(org.PlanType)) return BadRequest("Plan not allowed for MSP.");

static bool MspAllows(PlanType t) => t is PlanType.TeamsMonthly or PlanType.EnterpriseMonthly;

When it happens

Trigger: Adding/assigning an organization whose PlanType is Free, Families, TeamsAnnually, EnterpriseAnnually, or any non-monthly tier to an MSP provider via AddOrganization or a flow calling ThrowOnInvalidPlanType.

Common situations: Migrating an annually-billed org under an MSP without first switching billing; attempting to add a Free-tier org; plan data mismatch after a pricing migration.

Related errors

• Business Unit Providers cannot manage organizations with the
• Providers cannot manage organizations with the requested pla
• The organization is subscribed to Secrets Manager. Please co
• Provider plan not found.
• Failed to remove organization vault. Please contact support.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/7f75112c01181bbc. Report an issue: GitHub.