bitwarden/server · error · BadRequestException

Organization must have at least one confirmed owner.

Error message

Organization must have at least one confirmed owner.

What it means

Thrown by RemoveOrganizationFromProvider when HasConfirmedOwnersExceptAsync returns false with includeProvider: false, meaning the organization has no confirmed owners outside the provider's scope. Detaching such an org would orphan it with nobody able to manage it. BadRequestException (HTTP 400); message from OrgMustHaveConfirmedOwner.

Source

Thrown at bitwarden_license/src/Commercial.Core/AdminConsole/Providers/RemoveOrganizationFromProviderCommand.cs:79

    public async Task RemoveOrganizationFromProvider(
        Provider provider,
        ProviderOrganization providerOrganization,
        Organization organization)
    {
        if (provider == null ||
            providerOrganization == null ||
            organization == null ||
            providerOrganization.ProviderId != provider.Id)
        {
            throw new BadRequestException(new FailedToRemoveOrganizationFromProviderError().Message);
        }

        if (!await _hasConfirmedOwnersExceptQuery.HasConfirmedOwnersExceptAsync(
                providerOrganization.OrganizationId,
                [],
                includeProvider: false))
        {
            throw new BadRequestException(new OrgMustHaveConfirmedOwner().Message);
        }

        var organizationOwnerEmails =
            (await _organizationRepository.GetOwnerEmailAddressesById(organization.Id)).ToList();

        organization.BillingEmail = organizationOwnerEmails.MinBy(email => email);

        await ResetOrganizationBillingAsync(organization, provider, organizationOwnerEmails);

        await _organizationRepository.ReplaceAsync(organization);

        await _providerOrganizationRepository.DeleteAsync(providerOrganization);

        await _eventService.LogProviderOrganizationEventAsync(
            providerOrganization,
            EventType.ProviderOrganization_Removed);
    }

View on GitHub (pinned to e93b962371)

Solutions

1. Confirm at least one organization owner directly on the organization (not via provider) before detaching.
2. Pre-check with _hasConfirmedOwnersExceptQuery.HasConfirmedOwnersExceptAsync(orgId, [], includeProvider: false) and surface a clear message.
3. Add a direct owner user to the org first if none exists.

Example fix

// before
await _removeOrgCommand.RemoveOrganizationFromProvider(provider, providerOrg, org);

// after
if (!await _hasConfirmedOwnersExceptQuery.HasConfirmedOwnersExceptAsync(org.Id, [], includeProvider: false))
    throw new InvalidOperationException("Add and confirm a direct org owner before unlinking from the provider.");
await _removeOrgCommand.RemoveOrganizationFromProvider(provider, providerOrg, org);

if (!await _hasConfirmedOwnersExceptQuery.HasConfirmedOwnersExceptAsync(
        organization.Id, [], includeProvider: false))
    throw new InvalidOperationException("Organization must have a confirmed owner before unlinking from the provider.");

try { await _removeOrgCommand.RemoveOrganizationFromProvider(provider, providerOrg, org); }
catch (BadRequestException ex) when (ex.Message.Contains("confirmed owner"))
{ /* prompt admin to add/confirm a direct owner first */ }

When it happens

Trigger: Detaching an organization whose only confirmed owners were established through the provider; once unlinked, no direct confirmed org owner would remain.

Common situations: MSP-managed orgs where all owners were auto-confirmed via the provider; attempting to unlink without first adding a direct confirmed owner.

Related errors

• Failed to remove organization vault. Please contact support.
• Provider must have at least one confirmed ProviderAdmin.
• Invalid owner. Owner must be an existing Bitwarden user.
• Invalid owner.
• Invite the user first.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/5d7435b5f7fee921. Report an issue: GitHub.