Prisma Cloud: Unable to login the SSO login error "Authentication Failed: Either the user does not exist or (s)he does not have SSO login access."

• All users were unable to log in to the Prisma Cloud Console using their standard credentials via SSO (SAML with Azure AD).

• Upon login attempt, users were redirected to the Identity Provider (IdP) page, but authentication failed and returned an error message on the Prisma login page.

Prisma Cloud

CSPM

Prisma cloud Enterprise edition

This issue can occur if there is a change in the IdP configuration, such as modifications to SAML attributes or user identity mappings. In this case, the problem was caused by a change in the user email format in Azure AD from @xyz.in to @xyz.com, which led to a mismatch between the SAML assertions and existing Prisma Cloud user accounts.

• In Azure AD, the email format for users was changed from @rbl.in to @rbl.com, which caused a mismatch with existing Prisma Cloud user accounts.
• To fix this, we went to Settings > Access Control in Prisma Cloud and created new users with the updated email IDs matching the Azure AD format. Once the new users were added and the old ones removed, all users were able to log in successfully to the Prisma Cloud Console.