OneLogin - User receives "account doesn't exist" after SSO in Office 365 (4383004)

OneLogin - User receives "account doesn't exist" after SSO in Office 365

 A user can complete the SSO flow after authenticating with OneLogin, but then receives a message in Office 365 indicating that the account does not exist in Microsoft 365/Office 365. ​

This can occur when a user record in OneLogin is associated with multiple conflicting Entra ID external directories. 

This issue can be caused by a customer-side architecture and directory configuration in which the same OneLogin user is affected by multiple directory sources that conflict with one another. ​ In the reviewed case, the likely contributing factors were:

• The user was linked to more than one external directory. First being AD and second Entra ID
• One of those directory relationships resulted in the user being suspended in OneLogin.
• The OneLogin user object contained an ImmutableID that did not match the corresponding user in the Entra ID/Microsoft 365 tenant.
• The mismatched directory relationship caused the OneLogin object to be built from the wrong source attributes.

Verify and correct the authoritative identity source for the affected user, and ensure the ImmutableID in OneLogin matches the ImmutableID in Entra ID. ​ Recommended steps:

1. Confirm whether the user is active in the source Active Directory.
2. If the user is suspended in OneLogin due to directory sync, reactivate the source account as needed and confirm that the change is reflected in OneLogin.
3. Review the user in OneLogin and identify whether the account is linked to multiple directories.
4. If an unnecessary external directory is attached to the user, remove that directory relationship so the user is sourced only from the correct directory.
5. If the OneLogin object was built from the wrong directory source, temporarily move the on-prem AD user out of the synced OU to remove the stale OneLogin user.
6. Move the AD user back into the synced OU so that OneLogin can recreate the user from the correct directory source.
7. Compare the recreated OneLogin ImmutableID with the ImmutableID in Entra ID / Microsoft 365.
8. If the values do not match, update the Microsoft-side ImmutableID or rebuild the identity mapping according to your Microsoft identity management procedure so both systems use the same value.

● OneLogin may use the external directory identity data to build the OneLogin user object. ● When multiple connected directories disagree about the same user, the resulting OneLogin object can contain incorrect identity attributes. ● A mismatched ImmutableID can cause Microsoft 365 / Office 365 to reject the post-SSO identity even when the OneLogin authentication step succeeds. ● If rebuilding the user is required, ensure the directory being kept is the intended authoritative source before allowing the user to resync. For accurate information on how the ImmutableID attribute works, please refer to this technical document> Provision User Attributes to Office 365 V2 > https://onelogin.service-now.com/support?id=kb_article&sys_id=8454efa587dc7e1039effea9cebb356f