A new user is auto-provisioned via SAML but reports limited access. What could be the issue?

Question

Options

• AIncorrect SAML attribute mapping
• BExpired session token
• CSystem status conflicts
• DDefault group permissions set to public

• A
  84% (31)
• B
  3% (1)
• C
  3% (1)
• D
  11% (4)

Explanation

When a user is auto-provisioned via SAML but has limited access, incorrect SAML attribute mapping (A) is the culprit - the identity provider sends user attributes (like role, department, or group membership) that must be correctly mapped to the service provider's permission model. If those mappings are misconfigured, the system can create the account but assign wrong or minimal permissions.

Why the distractors are wrong:

• B (Expired session token) affects an existing authenticated session, not the initial provisioning of a new account - the user would be logged out, not limited.
• C (System status conflicts) is too vague and typically causes provisioning failures entirely, not partial access.
• D (Default group permissions set to public) would actually grant more access than expected (overly permissive), not less - the opposite of the reported problem.

Memory tip: Think of SAML attribute mapping as a translator - if the translator sends the wrong job title to HR, you get the wrong badge access. "Auto-provisioned but limited" = the account exists but the attributes that determine access got lost in translation.

No community discussion yet for this question.