bitwarden/server · error · BadRequestException

Provider must have at least one confirmed ProviderAdmin.

Error message

Provider must have at least one confirmed ProviderAdmin.

What it means

Thrown inside SaveUserAsync when changing the user's Type away from ProviderAdmin would leave the provider with zero confirmed ProviderAdmins. HasConfirmedProviderAdminExceptAsync excludes the user being saved and finds no remaining confirmed admins. BadRequestException (HTTP 400).

Source

Thrown at bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs:364

            }
        }

        await _eventService.LogProviderUsersEventAsync(events);

        return result;
    }

    public async Task SaveUserAsync(ProviderUser user, Guid savingUserId)
    {
        if (user.Id.Equals(default))
        {
            throw new BadRequestException("Invite the user first.");
        }

        if (user.Type != ProviderUserType.ProviderAdmin &&
            !await HasConfirmedProviderAdminExceptAsync(user.ProviderId, new[] { user.Id }))
        {
            throw new BadRequestException("Provider must have at least one confirmed ProviderAdmin.");
        }

        await _providerUserRepository.ReplaceAsync(user);
        await _eventService.LogProviderUserEventAsync(user, EventType.ProviderUser_Updated);
    }

    public async Task<List<Tuple<ProviderUser, string>>> DeleteUsersAsync(Guid providerId,
        IEnumerable<Guid> providerUserIds, Guid deletingUserId)
    {
        var provider = await _providerRepository.GetByIdAsync(providerId);

        if (provider == null)
        {
            throw new NotFoundException();
        }

        var providerUsers = await _providerUserRepository.GetManyAsync(providerUserIds);
        var users = await _userRepository.GetManyAsync(providerUsers.Where(pu => pu.UserId.HasValue)

View on GitHub (pinned to e93b962371)

Solutions

1. Confirm or promote another user to ProviderAdmin before demoting the current one.
2. Pre-check with HasConfirmedProviderAdminExceptAsync(providerId, new[] { user.Id }).
3. Ensure at least one other confirmed ProviderAdmin exists.

if (user.Type != ProviderUserType.ProviderAdmin &&
    !await HasConfirmedProviderAdminExceptAsync(user.ProviderId, new[] { user.Id }))
    throw new InvalidOperationException("Demoting this user would leave the provider with no confirmed ProviderAdmin.");

try { await _providerService.SaveUserAsync(user, savingUserId); }
catch (BadRequestException ex) when (ex.Message.Contains("confirmed ProviderAdmin"))
{ /* promote/confirm another admin first */ }

When it happens

Trigger: Demoting the last confirmed ProviderAdmin to a lower role; all other admins are only Invited (not Confirmed).

Common situations: Demoting the sole admin; admins never completed their own acceptance/confirmation.

Related errors

• Organization must have at least one confirmed owner.
• Invalid owner. Owner must be an existing Bitwarden user.
• Failed to remove organization vault. Please contact support.
• Invalid owner.
• Invite the user first.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/c25213f5280661e1. Report an issue: GitHub.