## TL;DR
Repair the SAML trust between Rippling and the app, then re-provision the one employee. Compare the entity id, reply URL, and certificate in Rippling with the values the app expects, fix the mismatched field, confirm the hire email format matches the NameID the app receives, and test sign-in before re-running provisioning for the wider group.

```text
Rippling app provisioning failed: SSO SAML configuration error for new employee
```

## Use this when
- Adding the employee to a Rippling-managed app fails with a SAML or SSO configuration message.
- Existing employees sign in to the same app normally, or all employees fail after an app-side change.
- The app assignment in Rippling shows an error state for the new hire.

## Not for this skill when
- The employee cannot sign in to Rippling itself. Fix Rippling account access first.
- The app failure is a seat or license limit with no SAML mention. Handle capacity instead.

## Steps
1. Open Rippling, go to the affected app, and read the full provisioning error for the employee, noting whether it names metadata, certificate, NameID, or a reply URL problem. Open the app SSO settings in Rippling beside the app own SAML configuration page for a side-by-side comparison. Verify: the error element is identified
2. Compare the three trust values in both places: the identity provider entity id, the app reply or assertion consumer URL, and the signing certificate fingerprint and expiry. Any one mismatch breaks the trust, and certificate expiry after an IdP rotation is the most common silent cause. Verify: every differing value is listed
3. Fix the stale side: if Rippling rotated its certificate or metadata, upload the current Rippling metadata into the app; if the app changed its reply URL during a migration, update the Rippling app configuration to match. Avoid changing both sides at once without recording originals. Verify: both sides now show identical trust values
4. Check the identifier mapping: confirm the NameID format the app expects, usually email address, matches the employee work email Rippling sends, and that no employee has a mismatched personal email in the field. Correct the Rippling employee record or the mapping if a different attribute is required. Verify: a sample assertion for the hire carries the expected NameID
5. Test with the affected employee: trigger the Rippling provisioning or SSO test if offered, then have the hire sign in to the app through Rippling and confirm the account inside the app is created or linked with the right role. Verify: the hire reaches the app signed in with correct access
6. Re-run provisioning for any other employees left in error from the same cause, and record the certificate expiry date in the IT calendar with a reminder ahead of the next rotation. Verify: no employees remain in SAML error for the app and the reminder exists

## Why it happens
SAML provisioning depends on both sides holding identical trust material and agreeing on the user identifier. Rippling or the target app can change one side independently, a certificate rotation, a URL migration, a metadata refresh, and the integration keeps working for existing sessions while new employee provisioning, which exercises the full assertion and account creation path, fails first. New hires are therefore the canary for SAML drift. Comparing the trust values directly finds the drift in minutes, while retrying provisioning against mismatched trust can never succeed.

## Variants and edge cases
### App supports metadata URL refresh
Where the app can fetch metadata from a URL, switch it from a static upload to the Rippling metadata URL so future rotations propagate automatically.

### Multiple Rippling apps fail together
Simultaneous failures point to a Rippling-side rotation. Update the shared metadata once per app and test each app sign-in, since each app stores its own copy.

### NameID must be an employee number
A few legacy apps require a non-email NameID. Map the Rippling field for that app only and document the exception so a later cleanup does not revert it.

Compatibility: Applies to Rippling app management with SAML SSO to third-party SaaS apps. Requires Rippling admin and target app admin access.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_2myxl3bgcH-gpA3PM5qgMg