## TL;DR
Same root cause as the Okta variant: the identity is fine, the app assignment is missing. Add the user to the app's assignment list in the identity provider, wait for group propagation if group-based, and retry.

```text
"SSO login failed" user is not assigned to this application
```

## Use this when
- Any IdP (Okta, Entra, Google) rejects SSO login with a not-assigned error.
- The user authenticates to the IdP successfully.
- The failure is per-user, not org-wide.

## Not for this skill when
- The IdP login itself fails. That is authentication.
- The app opens but denies an action. That is in-app authorization.
- Nobody can log in. That is app or IdP config.

## Steps
1. Identify which IdP issued the error. Verify: you are fixing assignment in the right console.
2. Open the app's assignment list in that IdP. Verify: the user or their group is actually missing.
3. Add the user directly or to an assigned group. Verify: the assignment is recorded.
4. If group-based, wait several minutes for propagation. Verify: the user shows as effectively assigned.
5. Retry the login. Verify: the SSO flow completes.

## Variant phrasings
### SAML user not assigned
The protocol-first phrasing.
### "application not assigned" SSO
The message-first search.
### IdP access denied
The generic phrasing.

Compatibility: Okta, Microsoft Entra ID, Google Workspace, and any SAML or OIDC IdP with app assignments.

## Why it happens
Assignment is the authorization gate for SSO apps in every major IdP. HR-driven provisioning creates the identity, but the app assignment is a separate grant that is easy to miss for new hires and team movers.

## Edge cases / pitfalls
- Just-in-time provisioning creating the user in the app without the IdP assignment firing.
- Group propagation delays making a fresh assignment look broken for several minutes.
- Assignment present but an app-level sign-on policy denying; check both layers.
- The user assigned under a different username format than the one they log in with.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_xs5T4uYrgnY_tFuPr30Cwg