The user in Connect encounters an Error Message: Access Denied. Your account has been authenticated but has not been onboarded to this application.

Question

A user from the customer encounters the error message: Access Denied. Your account has been authenticated but has not been onboarded to this application. He was the only user from the customer that encounters the error.

We have deleted and created the agent in User Management on Connect a couple of times and the user still encounters the error. We confirmed that the agent uses the same login email in their SSO and in Connect.

We have also found the documentation: https://docs.aws.amazon.com/connect/latest/adminguide/troubleshoot-saml.html, but we're still waiting for the customer to provide the HAR file.

Would like to ask if we have other solutions we could do to be able to onboard the agent?

Answer

Hi there!

This typically happens when the principal relayed from your SAML 2.0 IdP does not match exactly what has been created in the Amazon Connect user management page. You can see what principal is being passed from your IdP using [CloudTrail](https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html). Ensure that that matches exactly, including capitalization and punctuation. Some IdP's rewrite these when federating to an external system like Connect.

The user in Connect encounters an Error Message: Access Denied. Your account has been authenticated but has not been onboarded to this application.

Contenus pertinents