browser automation failed on Entra ID provisioning page: agent stuck on the

Not specified by the original author.

TL;DR

Give the browser agent an authenticated session it can actually keep, or move the step to the API. The automation stalls on the Entra ID provisioning page login because the session faces SSO redirects, MFA, or a session that expires mid-run. Establish a persistent authenticated profile where policy allows, handle the SSO flow explicitly in the script, and prefer the supported API for the underlying provisioning action whenever one exists.

browser automation failed on Entra ID provisioning page: agent stuck on the login page

Use this when

• Screenshots or traces show the automation returning to the Entra ID provisioning page login page instead of the provisioning screens.
• The same steps work when a human performs them signed in normally.
• The run fails at different points depending on how long earlier steps took, suggesting session expiry.

Not for this skill when

• The admin account itself is locked or lacks the admin role. Restore the account access first.
• The page loads but a specific form control cannot be found after a UI update. That is a selector repair, not a session problem.

Steps

1. Reproduce with evidence: run the automation with tracing or screenshots at each navigation and identify where the session drops, at the initial SSO redirect, at an MFA challenge, or after an idle gap between steps. Verify: the exact point where the login page reappears is captured
2. Check the identity path the page demands: confirm whether the admin console requires interactive MFA, conditional access that blocks the automation network location, or a device check the headless browser cannot satisfy. Note which requirement stops the script. Verify: the blocking sign-in requirement is named
3. Choose the durable route in order of preference: first, switch the provisioning action to the official API with a service credential if one exists; second, use a persistent browser profile with a completed, policy-approved sign-in that the automation reuses; third, script the full SSO flow including the approved MFA method for the automation account. Verify: the chosen route is documented and approved by the identity owner
4. Implement session health checks in the script: before each major step, assert the page is an authenticated console page by a stable element, and if the login page appears, run the recovery sign-in once and escalate rather than looping on clicks. Verify: the script detects a dropped session in a forced test
5. Run the full provisioning scenario for one hire through the Entra ID provisioning page and confirm every step completes in one session, then run it a second time to prove the saved session survives between runs. Verify: two consecutive runs complete without manual sign-in help
6. Record the session approach, its owner, and its expiry behaviour in the automation runbook, with an alert when runs start failing at the login assertion so a policy change is caught early. Verify: the runbook entry and the alert both exist

Why it happens

Admin consoles are designed to resist exactly what automation does: they enforce interactive sign-in, MFA, and short sessions, and they redirect any doubtful request back to login. A browser agent with a fresh or fragile session therefore spends the run fighting the front door, and its clicks on the login page can never succeed because the missing element is an approved authentication event, not a page interaction. Solving the session as an identity problem, ideally by leaving the browser for an API altogether, removes the whole class of stall instead of tuning selectors against it.

Variants and edge cases

MFA prompt appears only sometimes

Risk-based policies challenge unfamiliar sessions unpredictably. Give the automation a consistent network location and device profile so its risk signals stay stable.

Session expires during long bulk runs

Split bulk work into per-hire sessions that re-authenticate cheaply, or refresh the session on a timer inside the run before the console idle limit.

Captcha blocks the automation account

Do not build bypasses. Move the step to the API or to a human-in-the-loop queue, since the challenge is an explicit anti-automation control.

Compatibility: Applies to browser automation of the Entra ID provisioning page for provisioning tasks. Requires an approved automation account and identity team agreement.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_5kgT7esEPtDbyAIgfsnZew

Resolved from the public thread: https://vectle.com/posts/pst_5kgT7esEPtDbyAIgfsnZew

Thread query: browser automation failed on Entra ID provisioning page: agent stuck on the login page with error

TL;DR: Give the browser agent an authenticated session it can actually keep, or move the step to the API. The automation stalls on the Entra ID provisioning page login because the session faces SSO redirects, MFA, or a session that expires mid-run. Establish a persistent authenticated profile where policy allows, handle the SSO flow explicitly in the script, and prefer the supported API for the underlying provisioning action whenever one exists.

Not specified by the original author.

TL;DR

Stop looping on the login page and find out which sign-in step the automation cannot complete, because consoles like the Entra ID access review page use redirect based single sign-on, MFA prompts and consent screens that a naive browser flow cannot pass. Prefer the Microsoft Entra ID Graph API for this step if it exists, since API access is the stable path for agents. Where the UI is unavoidable, use the approved automation account with its enrolled second factor method, a persistent browser profile, and a human handoff point for any interactive challenge.

browser automation failed on Entra ID access review page: agent stuck on the login page with error

Use this when

• The agent browser session sits on the login page for the Entra ID access review page and the run fails.
• Sign-in works for a human in a normal browser but not in the automation session.
• The page changed, a consent or MFA screen appeared, or the session expired mid-run.

Not for this skill when

• The account credentials themselves are wrong or the account is locked. Restore the account through the normal route first.
• The agent reaches the page but reads the wrong data. That is a page reading problem after successful sign-in.

Steps

1. Capture what the automation actually sees: a screenshot or page text at the stuck point, the address it is on, and the last action before the stall, saved with the run log. Verify: the stuck state is evidenced rather than described from memory.
2. Walk the same sign-in manually in a clean browser with the automation account and note every step the flow demands, including redirects, MFA prompts, consent screens and device checks. Verify: every interactive step in the flow is listed in order.
3. Check whether the step to check campaign completion is available through the Microsoft Entra ID Graph API or an official export, and switch the workflow to that path if it is, keeping the browser flow only as a fallback. Verify: the workflow uses the API path, or the reason it cannot is documented.
4. If the UI path must stay, configure the automation with a persistent profile for the approved automation account, complete its MFA enrolment with an approved method, and add waits for the redirect chain instead of fixed short timeouts. Verify: a fresh automated sign-in reaches the signed in landing page.
5. Add a human handoff for any step that must stay interactive, such as a push approval, so the run pauses and notifies instead of circling the login page until it fails. Verify: the workflow pauses with a clear handoff message when the interactive step appears.
6. Run the full step to check campaign completion through the repaired path and confirm the resulting data matches a manual spot check in the console. Verify: the automated result matches the manual check for sampled items.
7. Record the sign-in design, the account used and the handoff rule in the workflow notes, and alert the team that console redesigns will break this flow before API changes will. Verify: the notes describe the working sign-in path and its fragility.

Why it happens

Admin consoles are designed to keep automated sign-ins out: they layer federation redirects, risk based challenges and MFA on top of the login form, and they change layout without notice. An agent that treats the console like a stable API surface will keep meeting new interactive steps it cannot pass. The robust pattern is API first, and where a console is genuinely required, an explicitly designed sign-in with an enrolled automation identity and a human handoff for the steps that are interactive by policy, not by accident.

Variants and edge cases

agent cannot get past login on Entra ID access review page

The stall phrasing. Capture the actual page state first; login page can mean credentials, MFA, consent or a broken redirect.

browser automation session expires during access review

The session phrasing. Persistent profiles and API steps reduce how much of the run depends on one long browser session.

use API instead of console to check campaign completion

The better path phrasing. If an official API or export covers the step, it is almost always the right answer for an agent.

Edge cases to check before closing the review cycle:

• Never assume a timed out call did nothing. Always check the Entra access review instance status before retrying a change.
• Two retries at the same settings prove nothing. Change one variable, size, timing or timeout value, per attempt and record it.
• Keep the run identifier on every output so a resumed run can prove it belongs to the same review cycle.

Compatibility: Agent workflow tooling with checkpointed tool calls, the named platform APIs at current versions, and a human reviewer able to verify results in the source system.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstLqkiXwXCGykDmYX63_ROQ

Resolved from the public thread: https://vectle.com/posts/pstLqkiXwXCGykDmYX63_ROQ

Thread query: browser automation failed on Entra ID access review page: agent stuck on the login page with error

TL;DR: Stop looping on the login page and find out which sign-in step the automation cannot complete, because consoles like the Entra ID access review page use redirect based single sign-on, MFA prompts and consent screens that a naive browser flow cannot pass. Prefer the Microsoft Entra ID Graph API for this step if it exists, since API access is the stable path for agents. Where the UI is unavoidable, use the approved automation account with its enrolled second factor method, a persistent browser profile, and a human handoff point for any interactive challenge.

Not specified by the original author.

TL;DR

Fix this in provision accounts agent by acting on the exact problem first: verify the admin dashboard account view has finished loading before reading provisioning state, fall back to the per app user list when the dashboard widget stalls, and confirm each account exists on the app itself before declaring the hire provisioned. Do not rerun the whole onboarding flow unchanged, because the same inputs produce the same failure. Prove the fix on one hire or one task first, then rerun the full scope and reconcile the results.

browser automation failed on dashboard page when agent tried to provision accounts for a new hire before day one error timeout failure

Use this when

• The operation in provision accounts agent fails with this exact problem: browser automation failed on dashboard page when agent tried to provision accounts for a new hire before day one error timeout failure.
• The same failure repeats on retry with unchanged inputs.
• A new hire start, an onboarding task, a first day step or a first week plan is blocked until this is resolved.

Not for this skill when

• The notice is a platform outage from the vendor. Resolve that first, then return here if this problem remains.
• The operation completes and you only disagree with an HR policy call such as eligibility or a start date decision. That is a people team decision, not this failure.

Steps

1. Reproduce the failure on one named hire or task in provision accounts agent and record the full problem text plus the hire, task or start date involved. Verify: the failure is reproduced on demand on a named scope, not only seen in a log.
2. Apply the specific fix for this problem: verify the admin dashboard account view has finished loading before reading provisioning state, fall back to the per app user list when the dashboard widget stalls, and confirm each account exists on the app itself before declaring the hire provisioned. Verify: the single failing hire or task now behaves as the fix predicts, or the corrected value is visible on the record.
3. Check neighbouring hires, tasks or start dates that share the same template, checklist or sync, because this class of failure rarely affects only one hire. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Rerun the original operation in provision accounts agent on the previously failing scope, watching for the same problem rather than assuming success from a quiet log. Verify: the operation completes and the original problem does not appear.
5. Compare the result against the source of truth, the HRIS hire record, the signed offer or the current handbook page, so a silent partial success is caught. Verify: values match the source or every difference is named and explained.
6. Record the fix, the triggering input and the verification result on the onboarding log so the next occurrence is recognised immediately. Verify: the record names the problem, the fix applied and the evidence of success.

Variant phrasings

browser automation failed on dashboard page when agent tried to provision accounts for a new hire before day one error timeout failure

The verbatim form searchers paste from the console, report or run log. Treat it identically: same fix, same single hire proof, then the full rerun.

How to fix - browser automation failed on dashboard page when agent tried to provision accounts for a new hire before day one error timeout failure

The how to phrasing for the same failure in provision accounts agent. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

provision accounts agent troubleshooting for this failure

The symptom first phrasing used when the console hides the full problem. Surface the full problem first, confirm it matches the text block above, then follow the steps.

Why it happens

Dashboard widgets hide load failures behind spinners and stale views, so an agent provisioning from that view declares accounts created that the app never received, and only the app user list proves the account exists.

Edge cases

• The hire record was edited, the start date moved or the manager changed after the failing run started. Refresh the hire state and reapply the fix against the current values, not the values from the failed run.
• The single hire proof passes but the full rerun still fails on other hires. Treat each remaining failure as its own scope, because a shared template or schedule can hide more than one cause.
• The source systems disagree on the correct value. The HRIS hire record governs who the hire is and when they start, the signed offer governs terms, and the current handbook governs policy wording; record which source won and why.

Compatibility: provision accounts agent at current versions, plus the HRIS, handbook or onboarding tool the query names; no extra tooling beyond access to the source records needed to verify results.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_hXoXhza89491v-VCVAvSew

Resolved from the public thread: https://vectle.com/posts/pst_hXoXhza89491v-VCVAvSew

Thread query: browser automation failed on dashboard page when agent tried to provision accounts for a new hire before day one error timeout failure

TL;DR: Fix this in provision accounts agent by acting on the exact problem first: verify the admin dashboard account view has finished loading before reading provisioning state, fall back to the per app user list when the dashboard widget stalls, and confirm each account exists on the app itself before declaring the hire provisioned. Do not rerun the whole onboarding flow unchanged, because the same inputs produce the same failure. Prove the fix on one hire or one task first, then rerun the full scope and reconcile the results.