ChatGPT SSO Login Errors: A UK Workspace Fix

ChatGPT single sign-on problems are usually identity mapping or network problems, not ChatGPT problems. Collect the exact error before you touch the identity provider or the workspace.

Symptoms

• "Continue with SSO" or the workspace sign-in page returns an error after the identity provider (IdP) has accepted the password.
• The user lands in a personal ChatGPT account instead of the company workspace.
• Sign-in works for some staff and fails for a new starter or a renamed user.
• Everyone fails at once, usually on a Monday or after a change weekend.
• The error mentions SAML, an assertion, a certificate, a domain or "user not found".

Write down the exact wording, the time, the user's email address as typed, the device and whether they were on the office network or the VPN. Half of these cases are solved by the error text alone.

Likely causes, most common first

1. Email mismatch. ChatGPT Team and Enterprise match users on email address. If the IdP sends a different value in the NameID or email claim from the address the workspace knows, for example a legacy UPN or an alias, the sign-in fails or creates the wrong identity.
2. User not assigned. In Microsoft Entra ID or Okta, the user is not assigned to the ChatGPT enterprise application, or is in the wrong group. The IdP signs them in, then refuses to issue an assertion for that app.
3. Wrong sign-in route. The user is typing a password into the standard ChatGPT login, or using a personal account, instead of the SSO route for the workspace domain.
4. Domain not verified or not enforced. SSO in ChatGPT depends on a verified domain. A second domain, a subsidiary or a recent rebrand may not be covered.
5. Certificate expired. SAML signing certificates expire. When the IdP rotates the certificate and the ChatGPT side still holds the old one, every user fails at the same moment.
6. Conditional Access or device policy. A policy that requires a compliant device, a specific location or phishing-resistant MFA can block the token for the ChatGPT app while other apps keep working.
7. Network path. A proxy or firewall that allows chatgpt.com but blocks the OpenAI authentication domains breaks the redirect back from the IdP.

Step-by-step fix

1. Reproduce it with one user in a private browsing window, from the official sign-in route for your workspace. Note the exact error.
2. Check the OpenAI status page for an authentication incident before changing anything.
3. Compare the email address. Look at the user in the ChatGPT admin console and at the claim the IdP sends. In Entra ID, the sign-in logs show the attributes issued for the application. They must match exactly.
4. Confirm the assignment. Check the user or their group is assigned to the ChatGPT enterprise app and that any provisioning (SCIM) has created the account in the workspace.
5. Check the certificate. Open the enterprise app's SAML configuration and confirm the active signing certificate matches the one uploaded on the ChatGPT side. If it has been rotated, update ChatGPT and retest.
6. Check Conditional Access. In the Entra ID sign-in log for the failed attempt, look at the Conditional Access tab. A "failure" against a named policy tells you which rule blocked it.
7. Test from a phone hotspot with the VPN off. If it works there, the network is blocking part of the authentication redirect.
8. Retest with the original user after each change. Change one thing at a time.

What IT or the administrator should check

• The verified domains on the ChatGPT workspace cover every email domain staff actually use, including any older domain still used for logins.
• The IdP sends the primary email in the expected claim, and the workspace matching rule expects the same claim. Aliases and display names are not enough.
• Group-based assignment includes new starters automatically. A manual assignment step is the usual cause of "works for everyone except the new person".
• Certificate expiry dates are in the calendar with a named owner. Rotate ahead of time and update both sides in the same change window.
• Conditional Access policies that target all cloud apps are reviewed for the effect on the ChatGPT app. If you require compliant devices, staff on unmanaged phones will fail by design. Our page on Entra ID Conditional Access design covers how to structure that without breaking every SaaS app.
• Firewalls and proxies allow the OpenAI authentication domains as well as chatgpt.com. The full domain list is on OpenAI's network recommendations page.
• Personal ChatGPT accounts on the company domain are found and either invited into the workspace or removed, so that staff stop landing in the wrong place.

When to escalate to OpenAI

Open a support case from the workspace administrator account when the IdP logs show a successful assertion with the correct email, the certificate matches, the domain is verified, the status page is clear and ChatGPT still refuses the sign-in. Include the SAML trace or the IdP log entry with the timestamp, the user email, the plan and the exact error text. Support cannot see your IdP, so the log entry is what shortens the case.

Escalate to Microsoft or Okta when the IdP itself refuses to issue the assertion and the reason in its log is unclear.

Source basis

• Microsoft Learn: troubleshoot SAML-based single sign-on
• Microsoft Learn: debug SAML-based single sign-on to applications
• Microsoft Learn: manage certificates for federated single sign-on
• OpenAI status page