gravitational/teleport · error

app does not have SSO set up

Error message

app does not have SSO set up

What it means

Sentinel errNonSSOApp returned when fetching an Azure AD (Entra) enterprise application's single-sign-on settings succeeds but currentSingleSignOnMode is not 'federated'; the app was created without federated SSO configured, so its SAML metadata cannot be retrieved. Callers like the Access Graph ingest treat it as a signal to skip the app.

Source

Thrown at lib/integrations/azureoidc/accessgraph.go:37

import (
	"bytes"
	"compress/gzip"
	"context"
	"encoding/json"
	"errors"
	"io"
	"log/slog"
	"os"
	"path"

	"github.com/gravitational/trace"

	"github.com/gravitational/teleport/api/types"
	"github.com/gravitational/teleport/lib/msgraph"
	"github.com/gravitational/teleport/lib/msgraph/models"
)

var errNonSSOApp = errors.New("app does not have SSO set up")

// singleSignOnMode represents the possible values for `currentSingleSignOnMode` in `adSingleSignOn`
type singleSignOnMode string

const (
	// singleSignOnModeNone indicates that the application does not have SSO set up.
	singleSignOnModeNone singleSignOnMode = "none" //nolint:unused // this serves as documentation of a possible value.
	// singleSignOnModeFederated indicates federated SSO such as SAML.
	singleSignOnModeFederated singleSignOnMode = "federated"
)

// adSingleSignOn represents the response from https://main.iam.ad.ext.azure.com/api/ApplicationSso/{servicePrincipalID}/SingleSignOn
type adSingleSignOn struct {
	CurrentSingleSignOnMode singleSignOnMode `json:"currentSingleSignOnMode"`
}

// TAGInfoCache is the format for the file produced by CreateTAGCacheFile.
type TAGInfoCache struct {

View on GitHub (pinned to 1283425b60)

Solutions

1. Configure federated SSO (SAML) on the Azure enterprise application so currentSingleSignOnMode becomes federated
2. If the app is expected to be skipped, no action is needed — it is logged at debug and skipped

When it happens

Trigger: Thrown at lib/integrations/azureoidc/accessgraph.go:37 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/7c5258f0fc835911. Report an issue: GitHub.