I cannot log in with SSO
VaultPAM currently routes interactive SSO through a platform-managed Keycloak connection. Organization administrators cannot view or change that connection in VaultPAM or Keycloak.
Before troubleshooting
Do not enter the Tenant ID, Application ID or client secret from Directory Sync to repair an SSO login. Directory Sync uses a separate Microsoft Graph application and does not configure sign-in.
Symptoms and actions
Microsoft or Keycloak rejects the login
Examples include invalid_client, unauthorized_client, redirect_uri_mismatch, access_denied or a redirect back to the login page.
- Retry in a private browser window.
- Confirm you selected the intended Microsoft account.
- Record the time, visible error code and the VaultPAM environment.
- Contact VaultPAM support or your platform operator. They must inspect the platform-managed Keycloak/Entra configuration; an Org Admin cannot correct it in the shared realm.
Microsoft confirms my identity, but VaultPAM denies access
Authentication and VaultPAM access are separate. Your account must also have an active VaultPAM organization membership and role. Contact your organization administrator and ask them to verify your current membership and, where Directory Sync is used, your membership in an enabled mapped Entra group.
I expected my organization's own Entra or Okta connection
Organization-specific self-service SSO federation and Okta onboarding are not available in the current product version. See SSO federation availability.
Information to include in a support request
- VaultPAM environment and page URL;
- approximate failure time and timezone;
- visible error/reason code;
- whether Microsoft authentication completed;
- intended VaultPAM organization;
- whether another Microsoft account succeeds.
Do not include passwords, client secrets, tokens or full browser cookies.