no SSO provider returned from management. Please proceed wit

Error message

no SSO provider returned from management. Please proceed with setting up this device using setup keys https://docs.netbird.io/how-to/register-machines-using-setup-keys

What it means

Returned by authenticateWithDeviceCodeFlow when the getDeviceFlow management RPC fails with gRPC code NotFound (client/internal/auth/oauth.go:117-121). Management answered definitively: this account/domain has no IdP (SSO provider) configured, so no device authorization flow can be created. The message steers the user to setup keys, which are the non-SSO enrollment path.

Source

Thrown at client/internal/auth/oauth.go:119

		pkceFlowInfo.SetLoginHint(hint)
	}

	return pkceFlowInfo, nil
}

// authenticateWithDeviceCodeFlow initializes the Device Code auth Flow
func authenticateWithDeviceCodeFlow(ctx context.Context, config *profilemanager.Config, hint string) (OAuthFlow, error) {
	authClient, err := NewAuth(ctx, config.PrivateKey, config.ManagementURL, config)
	if err != nil {
		return nil, fmt.Errorf("failed to create auth client: %v", err)
	}
	defer authClient.Close()

	deviceFlowInfo, err := authClient.getDeviceFlow(authClient.client)
	if err != nil {
		switch s, ok := gstatus.FromError(err); {
		case ok && s.Code() == codes.NotFound:
			return nil, fmt.Errorf("no SSO provider returned from management. " +
				"Please proceed with setting up this device using setup keys " +
				"https://docs.netbird.io/how-to/register-machines-using-setup-keys")
		case ok && s.Code() == codes.Unimplemented:
			return nil, fmt.Errorf("the management server, %s, does not support SSO providers, "+
				"please update your server or use Setup Keys to login", config.ManagementURL)
		default:
			return nil, fmt.Errorf("getting device authorization flow info failed with error: %v", err)
		}
	}

	if hint != "" {
		deviceFlowInfo.SetLoginHint(hint)
	}

	return deviceFlowInfo, nil
}

View on GitHub (pinned to 93e97f4bf1)

Solutions

Enroll with a setup key instead: netbird up --setup-key <key> (https://docs.netbird.io/how-to/register-machines-using-setup-keys)
If SSO is intended, have the management administrator configure the IdP integration for the account/domain
Verify you are connecting to the intended management URL/account - a wrong domain can have no IdP while the real one does

Defensive patterns

Strategy: fallback

Try / catch

flow, err := auth.NewOAuthFlow(ctx, cfg, isDesktop, false, hint)
if err != nil {
	if strings.Contains(err.Error(), "no SSO provider returned from management") {
		// account has no IdP: switch to setup-key enrollment
		return enrollWithSetupKey()
	}
}

Prevention

Know your account's enrollment mode before running netbird up: setup-key accounts never support interactive SSO
Administrators: configure the IdP integration if interactive login is expected
Double-check the management URL - wrong accounts/domains often look like missing SSO

When it happens

Trigger: netbird up with interactive SSO login attempted against a management account where no IdP integration exists (devcert/local setups, fresh self-hosted installs, domains where the IdP config was deleted). The RPC itself succeeded - the answer is 'no provider'.

Common situations: Fresh self-hosted management without IdP configured; user mistakenly expects Google/Azure login on a plain setup-key-based deployment; IdP configuration removed from the account.

Related errors

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/541189902f918896. Report an issue: GitHub.