# SAML SSO Issue with Microsoft MyApps – “Not Authorized” Error **URL:** \ **Category:** SonarQube Server / Community Build\ **Tags:** authentication, authorization, azure, saml\ **Created:** [April 16, 2025, 11:51pm UTC](https://community.sonarsource.com/t/saml-sso-issue-with-microsoft-myapps-not-authorized-error/138903 "2025-04-16T23:51:45Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Yuriy.Samorodov](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/yuriy.samorodov/32/68684_2.png) [@Yuriy.Samorodov](https://community.sonarsource.com/u/Yuriy.Samorodov)\ **Post date:** [April 16, 2025, 11:51pm UTC](https://community.sonarsource.com/t/saml-sso-issue-with-microsoft-myapps-not-authorized-error/138903/1 "2025-04-16T23:51:45Z")
**Subject:** SAML SSO Issue with Microsoft MyApps – “Not Authorized” Error **Product:** SonarQube Enterprise v2025.1 (102418) **SSO Provider:** Microsoft Entra ID (formerly Azure AD) **Authentication Method:** SAML 2.0 - ✅ Direct link works: [https://sonarqube.domain.local](https://sonarqube.domain.local) - ❌ Microsoft MyApps link fails: [https://launcher.myapps.microsoft.com/api/signin/](https://launcher.myapps.microsoft.com/api/signin/)\* **Issue Description:** We have successfully configured SAML SSO for our SonarQube instance. Users are able to log in via the direct URL ([https://sonarcube.domain.local](https://sonarcube.domain.local)) without any issues. However, when attempting to access SonarQube using the **Microsoft MyApps** portal, authentication through Azure/Entra completes successfully, but users are redirected to the following SonarQube error page: ```auto https://sonarcube.domain.local/sessions/unauthorized ``` The message displayed is: > “You’re not authorized to access this page. Please contact the administrator.” ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/9/5/958e61a9144d2cb3a6f2cbae5fcbf56d5509cbce.png) * * * **Steps to Reproduce:** 1. Configure SAML SSO for SonarQube with Microsoft Entra. 2. Add SonarQube as an enterprise app in Microsoft MyApps. 3. Attempt login via the MyApps launcher ([https://launcher.myapps.microsoft.com/api/signin/](https://launcher.myapps.microsoft.com/api/signin/)). ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/1/b/1b7485cb8c53e51943af7455a575f49d981e0deb.png) 1. Observe that authentication succeeds but ends in an “unauthorized” page from SonarQube. * * * **Expected Behavior:** Users should be able to access SonarQube via the MyApps launcher just as they do using the direct link. * * * **DEBUG LOGS** ```auto 2025.04.17 00:38:22 DEBUG web[2d7a8cd3-bf2e-4e4c-8668-c3d7af6a6fe6][auth.event] login failure [cause|Cookie 'OAUTHSTATE' is missing][method|OAUTH2][provider|EXTERNAL|SAML][IP|100.126.123.0|172.21.252.50][login|] 2025.04.17 00:38:29 DEBUG web[6d7889c7-6587-43cb-9306-c17f05d98a69][auth.event] login failure [cause|Cookie 'OAUTHSTATE' is missing][method|OAUTH2][provider|EXTERNAL|SAML][IP|100.126.123.0|172.21.252.50][login|] 2025.04.17 00:38:36 DEBUG web[3abad1d4-6970-4727-8a5f-df359d6b5731][auth.event] login failure [cause|Cookie 'OAUTHSTATE' is missing][method|OAUTH2][provider|EXTERNAL|SAML][IP|100.126.123.0|172.21.252.50][login|] 2025.04.17 00:38:44 DEBUG web[][c.z.h.p.HikariPool] HikariPool-1 - Pool stats (total=10/10, idle=10/10, active=0, waiting=0) 2025.04.17 00:38:44 DEBUG web[][c.z.h.p.HikariPool] HikariPool-1 - Fill pool skipped, pool has sufficient level or currently being filled. 2025.04.17 00:38:46 DEBUG web[396da3af-00d8-44c1-92d8-f787ac3898f4][auth.event] login failure [cause|Cookie 'OAUTHSTATE' is missing][method|OAUTH2][provider|EXTERNAL|SAML][IP|100.126.123.0|172.21.252.50][login|] ``` * * * **Additional Notes:** - No authorization or role issues when accessing directly via the SonarQube URL. - All SAML attributes (NameID, groups, etc.) appear to be passed correctly during both flows. - We have tried to fill in `Relay State`, but it did not help. We used the following endpoints: `https://sonarqube.domain.local` `https://sonarqube.domain.local/` `https://sonarqube.domain.local/projects` `https://sonarqube.domain.local/projects/` `https://sonarqube.domain.local/account/projects` `https://sonarqube.domain.local/account/projects/` **Questions** - Is there any way to make MyApps link working for SonarQube? - Please advise if additional debug logs or configuration details are needed. ---
**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\ **Post date:** [April 18, 2025, 12:43pm UTC](https://community.sonarsource.com/t/saml-sso-issue-with-microsoft-myapps-not-authorized-error/138903/3 "2025-04-18T12:43:25Z")
Hi, Welcome to the community! You’ve configured SAML not with Entra, but with MyApps? Can you confirm that MyApps is sending the required `OAUTHSTATE` cookie? Also, this may be relevant: > [@SAML IDP Initiated Login](https://community.sonarsource.com/t/saml-idp-initiated-login/3704/6): > > This was a Firefox thing for me. I dug a little deeper, and it turned out to be a really odd interaction with Container tabs in Firefox. I was opening [https://sonar.example.com/sessions/init/saml?return\_to=%2F](https://sonar.example.com/sessions/init/saml?return_to=%2F) in a non-Container tab, but my SAML IdP domain was set to always open in my Work Container. As a result it lost the OAUTH\_STATE cookie set by /sessions/init/saml after it went to load the IdP. The flow is like this: (no Container) visit [https://sonar.example.com/sessions/init/saml?retu…](https://sonar.example.com/sessions/init/saml?return_to=%2F)   HTH, Ann