Overview

Recover user access after IdP attribute or certificate drift.

Audience

• Admin
• It Security

Product Area

Identity

Prerequisites

• SSO configured

Steps

1. Validate token claims

Inspect role, tenant, and issuer claims against expected values.

1. Resync identity

Trigger SCIM reconciliation and force new session issuance.

Expected Result

The Identity workflow completes without unresolved validation errors, and the result is visible to the intended roles.

Security and Audit Notes

• Use the least-privileged role that can complete the task.
• Confirm the resulting change or decision appears in the workspace audit trail when the workflow changes customer data or access.

Limits and Preconditions

• Available controls depend on the tenant plan, enabled modules, jurisdiction, and administrator policy.
• If a named control is not visible, confirm entitlement and role access before treating the behavior as a product failure.

Troubleshooting

• Expired signing certificate: Rotate IdP certificate and update metadata.

Related Articles

• Enable SSO and Enforce MFA

Escalation

If the documented result cannot be reached after the checks above, capture the workspace identifier, affected product area, timestamp, and a redacted error message, then use Support. Never include secrets, privileged legal content, or customer documents in the initial report.