This article explains how to fix common problems with Single Sign-On (SSO) sign-in to Big Think+.
Find what you see in the table below, then apply the fix in your identity provider (IdP).
What is going wrong, and how do I fix it?
| What you see | Likely cause | Fix |
An IdP error saying the user is not assigned or does not have access. Examples: Okta "not assigned this app", Entra AADSTS50105, Google 403 app_not_enabled_for_user. | The user is not assigned to the Big Think+ app, or (in Google) access is off for their organizational unit or group. | Assign the user or their group to the app in your IdP. Google access changes can take up to 24 hours. |
An IdP error about the application or Entity ID not being found. Examples: Entra AADSTS700016, Google 403 app_not_configured_for_user. | The Entity ID in your IdP does not match the one Big Think+ sends. | Set the Entity ID (Audience URI, Identifier) to plus.bigthink.com exactly: no https://, no trailing slash. |
| A 404 page after signing in at your IdP | The ACS URL is wrong. Most often /metadata was used instead of /acs, or the permalink is misspelled. | Re-enter the ACS URL from your setup guide. It must end in /acs and use your exact permalink. |
| A Big Think+ page saying "There was an error with the SSO process" | Big Think+ rejected the sign-in. The most common reasons are that your IdP's signing certificate no longer matches the metadata Big Think+ holds, or that the Entity ID in your IdP is not plus.bigthink.com. | Send current metadata to Partner Services with the time of the attempt; they can see the exact reason in our logs. |
| The user signs in but lands in the wrong account, or a duplicate account is created | The Name ID is not the user's email address (for example, an Entra UPN that differs from the email), or the user's email changed in your IdP. | Set the Name ID to the user's primary email address. Contact Partner Services about any duplicate accounts. |
| Users are not sent to your IdP from the Big Think+ sign-in page | Their email domain is not registered with Big Think+. | Send the missing domains to Partner Services. Meanwhile, users can sign in with your direct sign-in link (shown below the table). |
| People who should not have Big Think+ are getting accounts | The app is assigned too broadly in your IdP. Anyone your IdP lets sign in gets an account. | Limit assignment to licensed users or groups. |
Your direct sign-in link is https://plus.bigthink.com/o/<permalink>, where <permalink> is the organization permalink Big Think+ gave you.
What if I am still stuck?
Email your Partner Services contact (or partnerservices@bigthink.com) with the error message, a screenshot, the affected user's email and the time of the attempt.