### ALM used
Azure DevOps
### CI system used
Azure DevOps Pipelines
### Scanner command used when applicable
Not applicable. The issue occurs during SAML SSO authentication and user provisioning, before any analysis is executed.
### Languages of the repository
Multiple repositories (.NET, JavaScript, TypeScript)
### Error observed
We are configuring SAML SSO between SonarCloud Enterprise and Microsoft Entra ID.
Authentication appears to be successful on the Entra ID side. During SSO testing, Microsoft Entra ID reports that the SAML response has been successfully issued to the application.
However, when users access SonarCloud using the Enterprise SSO URL, they receive the following error:
User uuid <user_uuid> is not allowed to get enterprise uuid <enterprise_uuid>
Hi @Francisco-Pozo,
Welcome to the Community!
This error has a well-known cause: it occurs when the groups sent in the SAML assertion from Entra ID don’t match any group names in your SonarQube Cloud organization(s).
Even though Entra ID confirms the SAML response was issued successfully, SonarQube Cloud then attempts to map the user’s groups to its own organization groups for access. If no match is found, it cannot determine which organization to grant access to, producing this error.
Here’s how you can proceed:
- Check what groups Entra ID is sending — inspect the SAML assertion in your browser’s dev tools (Network tab → the SAML POST response) and look for the groups attribute.
- Create matching groups in SonarQube Cloud — go to your organization(s) under the enterprise and create groups whose names exactly match the Entra ID group names (case-sensitive).
- Assign permissions to those groups within the organization.
The docs cover this specifically for Entra ID: Setting up SAML SSO with Microsoft Entra ID and Verify User Groups.
If you’d prefer not to manage group matching manually, setting up SCIM provisioning is the longer-term solution: Set up SCIM.
Let us know if you’re still stuck after checking the group names.
Best regards,
Stevan