Troubleshooting — Counter Staff Cannot Log In (Entra SSO)

Symptoms

• Staff is redirected to Microsoft login but gets an error after authenticating
• "Unauthorized" message after the Entra redirect
• Staff stuck on login page after Microsoft authentication

Likely Causes

What Support Should Check

1. Admin → Users: Does the staff member have an account? Is entra_account_id populated?
2. Admin → Settings → Entra Domain: Is the custom Entra domain correctly configured?
3. Application error logs: search for EntraCallbackController errors.

Resolution Steps

1. Account not in SchoolAide: Create the user account in Admin → Users and assign the correct role.
2. Entra domain misconfigured: Admin → Settings → update the Entra Domain field.
3. PKCE failure (session expired): Ask the user to clear browser cookies and try again.
4. Azure app registration: Confirm the callback URL ({school}.schoolaide-q.com/auth/entra/callback) is listed in Azure AD app registrations.

What Engineering May Inspect

• app/Http/Controllers/Auth/EntraCallbackController.php
• app/Services/Entra/EntraOidcService.php — validateIdToken() and exchangeCode()
• Session storage for oauth.code_verifier and oauth.nonce