Domain verification
"No TXT record found" when I click Verify
Your DNS record hasn't been added, or hasn't propagated yet. Confirm you added a TXT record with host _refresh-verify.yourdomain.com and the exact value ReFresh showed. DNS changes can take a few minutes; wait and click Verify Now again.
"The TXT record does not match the expected token"
The value at your DNS provider doesn't match. Copy the value from ReFresh again and paste it exactly: no extra quotes or spaces. Some DNS providers wrap the value in quotes automatically; if yours does, don't add your own.
Verification times out
This is usually a temporary DNS lookup issue. Wait a moment and try again. If it persists, confirm the record is visible using a public DNS lookup tool.
"This domain is already claimed by another organisation"
Each domain can only be claimed once across ReFresh. If your organisation should own it, contact ReFresh support to resolve.
Setup and metadata
SAML metadata upload is rejected
Two limits apply: the file must be under 256 KB, and it must be real SAML metadata containing an EntityDescriptor. If you see "that file does not look like SAML metadata," you've likely uploaded the wrong file: download the IdP metadata from your provider (not the SP/ReFresh metadata) and try again. Where possible, use a Metadata URL instead so ReFresh can track certificate changes.
The client secret field says "Saved" and is blank
That's expected when editing an existing connection: the secret is stored (held only by the identity broker) and can't be shown again. Leave it blank to keep the current secret, or paste a new one to replace it.
Can't activate a connection
"Connection requires at least one verified bound domain to activate"
The domain this connection is set up for isn't verified (or was archived). Verify the domain first; see Setting up and managing SSO (Step 1: Claim and verify your domain).
"Connection cannot be activated without a default role or at least one role mapping"
ReFresh won't activate a connection that has no way to assign anyone a role: it would let people in with no access. Set a default role, or add at least one group/role mapping, on the Mappings step.
"Complete the identity provider settings before activating"
You skipped ahead. Finish the Paste IdP details step and run a successful test before activating.
I can't get past the Test step
You must have a successful test sign-in before activation unlocks. If your test shows "Blocked: Strict Mode," your connection has no default role and the account you tested isn't in any mapped group: add that user's group to a mapping, or set a default role.
Users can't sign in
When a sign-in is refused, ReFresh shows a reason. A Reference code may appear; include it if you contact support.
"Access Not Granted" / no role assigned
The person signed in successfully, but your organisation hasn't given them a role. Map their IdP group (or claim) to a ReFresh role, then have them try again. If you want everyone to get in, set a default role.
"Sign-In Temporarily Unavailable" / connection paused
The SSO connection for that domain is disabled/paused. Re-enable it, or activate another connection for the domain.
"Sign-In Blocked by Security Policy" (Microsoft Entra)
The account is from a different Entra tenant or is a guest. ReFresh validates the Entra tenant on every sign-in and blocks cross-tenant/guest accounts by design. The user must sign in with an account in your own Entra tenant.
"Your email domain is not linked to this SSO connection"
The user's email domain isn't the one this connection is bound to. Confirm they're using their correct work email, and that the domain is claimed, verified, and active.
Entra: "could not include your full group details" (group overage)
The user belongs to too many Entra groups, so Entra sent an overage marker instead of the group list and ReFresh couldn't read their groups. In your Entra app, configure it to emit only groups assigned to the application (see Microsoft Entra ID (4. Assign roles: use App Roles (recommended))).
Roles aren't mapping correctly
A mapping isn't matching, even though the group looks right
Three common causes:
You mapped a display name, not the ID. Map on the group's ID/GUID: names can be renamed and matching is exact.
Case mismatch. Matching is case-sensitive:
Admin-Group≠admin-group.Wrong claim name. If your IdP sends groups under a different attribute (e.g.
memberOf), set the Groups claim/attribute on the details step. Use the Test step's claims preview to see exactly what your IdP sends.
My provider sends groups as one text string and only some match
ReFresh splits string group values on comma, semicolon, pipe, or newline, but not spaces, because group names often contain spaces. If your provider sends space-separated groups, reconfigure it to send an array or use one of the supported delimiters.
Locked out
Our identity provider is down and admins can't sign in
There's no SSO password-bypass (by design; it would undermine your SSO requirement). Contact ReFresh support: support can disable the connection, which re-opens password sign-in for the domain. To avoid this, keep at least one admin whose email is on a domain that isn't SSO-enforced.