bitwarden/server · error · BadRequestException

Providers cannot manage organizations with the requested pla

Error message

Providers cannot manage organizations with the requested plan type ({requestedType}). Only Teams and Enterprise accounts are allowed.

What it means

Thrown by ProviderService.ThrowOnInvalidPlanType for a Reseller provider when the requested PlanType is in _resellerDisallowedOrganizationTypes (the configured set of plans resellers may not manage, generally anything outside Teams/Enterprise). BadRequestException (HTTP 400).

Source

Thrown at bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs:754

    {
        switch (providerType)
        {
            case ProviderType.Msp:
                if (requestedType is not (PlanType.TeamsMonthly or PlanType.EnterpriseMonthly))
                {
                    throw new BadRequestException($"Managed Service Providers cannot manage organizations with the plan type {requestedType}. Only Teams (Monthly) and Enterprise (Monthly) are allowed.");
                }
                break;
            case ProviderType.BusinessUnit:
                if (requestedType is not (PlanType.EnterpriseMonthly or PlanType.EnterpriseAnnually))
                {
                    throw new BadRequestException($"Business Unit Providers cannot manage organizations with the plan type {requestedType}. Only Enterprise (Monthly) and Enterprise (Annually) are allowed.");
                }
                break;
            case ProviderType.Reseller:
                if (_resellerDisallowedOrganizationTypes.Contains(requestedType))
                {
                    throw new BadRequestException($"Providers cannot manage organizations with the requested plan type ({requestedType}). Only Teams and Enterprise accounts are allowed.");
                }
                break;
            default:
                throw new BadRequestException($"Unsupported provider type {providerType}.");
        }
    }

    private async Task UpdateClientOrganizationsEnabledStatusAsync(Guid providerId, bool enabled)
    {
        var providerOrganizations = await _providerOrganizationRepository.GetManyDetailsByProviderAsync(providerId);

        foreach (var providerOrganization in providerOrganizations)
        {
            var organization = await _organizationRepository.GetByIdAsync(providerOrganization.OrganizationId);
            if (organization != null && organization.Enabled != enabled)
            {
                organization.Enabled = enabled;
                await _organizationRepository.ReplaceAsync(organization);

View on GitHub (pinned to e93b962371)

Solutions

1. Confirm the org plan is Teams or Enterprise before assigning to a Reseller.
2. Check the configured _resellerDisallowedOrganizationTypes to ensure intended tiers are allowed.
3. Upgrade consumer-tier orgs before reseller assignment.

Example fix

// before
await providerService.AddOrganizationsToReseller(resellerId, orgIds);

// after
var blocked = orgIds
    .Where(id => resellerDisallowedTypes.Contains(GetOrgPlanType(id)));
if (blocked.Any())
{
    return BadRequest("Some orgs are on plans a reseller cannot manage.");
}
await providerService.AddOrganizationsToReseller(resellerId, orgIds);

if (resellerDisallowedOrganizationTypes.Contains(org.PlanType)) return BadRequest("Plan blocked for reseller.");

static bool ResellerAllows(PlanType t, ISet<PlanType> blocked) => !blocked.Contains(t);

When it happens

Trigger: Assigning an organization whose PlanType is in the reseller-disallowed set (e.g. Free, Families, Starter) to a Reseller provider.

Common situations: Adding a consumer-tier org to a reseller; a misconfigured _resellerDisallowedOrganizationTypes set that excludes a valid tier after a pricing change.

Related errors

• Managed Service Providers cannot manage organizations with t
• Business Unit Providers cannot manage organizations with the
• The organization is subscribed to Secrets Manager. Please co
• Provider must be of type Reseller in order to assign Organiz
• Organizations must not be assigned to any Provider.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/6d6dd3e5397029e7. Report an issue: GitHub.