strapi/strapi · error · ApplicationError

This role is used as the default SSO role. Make sure to chan

Error message

This role is used as the default SSO role. Make sure to change this configuration before deleting the role

What it means

Thrown by the EE SSO role service when one of the role ids passed to ssoCheckRolesIdForDeletion matches the defaultRole stored in the admin 'auth' core store. It prevents deleting the role that SSO defaults new identities into, which would orphan SSO provisioning.

Source

Thrown at packages/core/admin/ee/server/src/services/role.ts:15

import { toString } from 'lodash/fp';
import { errors } from '@strapi/utils';

const { ApplicationError } = errors;

const ssoCheckRolesIdForDeletion = async (ids: any) => {
  const adminStore = await strapi.store({ type: 'core', name: 'admin' });

  const {
    providers: { defaultRole },
  } = (await adminStore.get({ key: 'auth' })) as any;

  for (const roleId of ids) {
    if (defaultRole && toString(defaultRole) === toString(roleId)) {
      throw new ApplicationError(
        'This role is used as the default SSO role. Make sure to change this configuration before deleting the role'
      );
    }
  }
};

export default {
  ssoCheckRolesIdForDeletion,
};

View on GitHub (pinned to 4a4101264d)

Solutions

1. Change the SSO defaultRole to a non-deleted role in the admin SSO settings before deletion.
2. Exclude the SSO default role id from the deletion batch.
3. After role reorg, re-point defaultRole and verify via the admin store before deleting.
4. Read adminStore.get({ key: 'auth' }).providers.defaultRole to confirm which id is protected.

Example fix

// before
// delete role 3 while auth.providers.defaultRole === '3'
// after
// update SSO default role to 4, then delete role 3

const adminStore = await strapi.store({ type: 'core', name: 'admin' });
const { providers: { defaultRole } } = await adminStore.get({ key: 'auth' });
if (ids.map(String).includes(String(defaultRole))) {
  throw new Error('Cannot delete the SSO default role; reassign defaultRole first');
}

try {
  await roleService.deleteRoles(ids);
} catch (e) {
  if (e instanceof ApplicationError && /default SSO role/i.test(e.message)) {
    // prompt to reassign defaultRole
  } else throw e;
}

When it happens

Trigger: Deleting an admin role whose id equals the configured SSO defaultRole (from the auth store).

Common situations: Reorganising roles without updating the SSO default; importing roles from another environment where ids differ; bulk-deleting roles including the SSO default.

Related errors

• Invalid provider supplied: ${providerName}
• You must have at least one user with super admin role.
• The name must be unique and a role with name `${attributes.n
• The name must be unique and a role with name `${sanitizedAtt
• You cannot delete the super admin role

AI-assisted analysis of strapi/strapi@4a4101264d (2026-08-12). Data as JSON: /api/errors/5fd904152aa73d1c. Report an issue: GitHub.