---
schema_version: "1"
id: fd9bd09a4d1406307a49e07883b4572c9c4009cf16b03cc149abe9deed5a0ada
title: Resolve Marketing Cloud Engagement Single Sign-On Errors
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/mktg/264-0-0/mc_overview_saml_error_resolution.md
canonical_url: https://help.salesforce.com/s/articleView?id=mktg.mc_overview_saml_error_resolution.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: fb5bdff91e9e0c7f41c0cdf7bee93ecdbdb70ee47a5de9e66c8fdda186e90388
description: Marketing Cloud Engagement returns an error message if an incorrect SAML assertion is received. Errors can occur during initial integration configuration or when you make modifications.
products:
  - Marketing
  - Marketing Cloud Engagement
release: "264"
---
# Resolve Marketing Cloud Engagement Single Sign-On Errors

Marketing Cloud Engagement returns an error message if an incorrect SAML assertion is received. Errors can occur during initial integration configuration or when you make modifications.

This table describes resolution recommendations for SAML authentication errors.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d44322e41">Error Message</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d44322e44">Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Error Message" class="slds-cell-wrap" style="vertical-align:top;" headers="d44322e41 ">
              <p style="margin-bottom:0;">
                <samp>Incoming SAML assertion or response from an issuer for which the
                  service provider has no metadata loaded or is wrong</samp>
              </p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d44322e44 ">The SAML message that was received from the identity provider contains an
              unknown entity ID. Confirm that the identity provider metadata configuration for
              your account includes the same entity ID that’s included with the SAML messages from
              your identity provider.</td>

          </tr>
          <tr class="">
            <td data-label="Error Message" class="slds-cell-wrap" style="vertical-align:top;" headers="d44322e41 ">
              <p style="margin-bottom:0;">
                <samp>Incoming SAML message is not properly formatted, is missing
                  elements, or includes invalid elements</samp>
              </p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d44322e44 ">
              <p>The system couldn’t process the message that it received from the identity
                provider because the message didn’t include all the required information in the
                correct format. This error can also occur because the system determined that some
                of the message elements were invalid. This message can include additional
                details.</p>
              <ul>
                <li><samp>Message was signed but signature could not be
                    verified</samp>—The system couldn’t validate the signature
                  contained in the message from the identity provider. Make sure that Engagement
                  uses the correct certificate from the identity provider.</li>

                <li><samp>Assertion contains an unacceptable Audience
                    Restriction</samp>—The message didn’t contain the expected
                  Audience Restriction value of <code>https://sp.exacttarget.com/shibboleth-sp</code>.</li>

                <li><samp>Assertion is no longer valid</samp> or
                  <samp>Message expired, was issued too long
                    ago</samp>—Both of these reasons indicate issues with the message
                  timestamp. These issues can occur if the system clock for the server that
                  generates the SAML messages is set to a time outside of the acceptable clock
                  skew range. To correct this error, ensure that the server’s system clock
                  provides an accurate value.
                </li>

                <li><samp>SAML response contained an error</samp>—The SAML
                  message from the identity provider contained an error status code. Make sure
                  that the identity provider is properly configured and that it returns the
                  expected successful SAML message status codes.</li>

              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Error Message" class="slds-cell-wrap" style="vertical-align:top;" headers="d44322e41 ">
              <p style="margin-bottom:0;">
                <samp>Incoming SAML message has security elements which are missing or
                  invalid</samp>
              </p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d44322e44 ">
              <p>The message received from the identity provider includes one or more invalid
                security elements. This error message can include additional details.</p>
              <ul>
                <li><samp>Message was signed but signature could not be
                    verified</samp>—The system couldn’t validate the signature
                  contained in the message from the identity provider. Make sure that Engagement
                  is configured to use the correct certificate from the identity provider.</li>

                <li><samp>Message expired, was issued too long
                    ago</samp>—There’s an issue with the message timestamp. This issue
                  can occur if the system clock for the server that generates the SAML messages is
                  outside of the acceptable clock skew range. Ensure that the server’s system
                  clock provides an accurate value.</li>

                <li><samp>Rejecting replayed message ID
                    (&lt;message-id&gt;)</samp>—The system already received a SAML
                  message with the provided ID. Ensure that your identity provider provides unique
                  message IDs for all SAML messages that it generates.</li>

              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Error Message" class="slds-cell-wrap" style="vertical-align:top;" headers="d44322e41 ">
              <p style="margin-bottom:0;">
                <samp>Incoming SAML assertion or response does not use an allowed
                  NameIDFormat</samp>
              </p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d44322e44 ">
              <p>The message contains a <code>NameIDFormat</code> value
                that isn’t allowed. Confirm that the <code>NameIDFormat</code> used in SAML messages includes a supported format.</p>
              <ul>
                <li>
                  <code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code>
                </li>

                <li>
                  <code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code>
                </li>

                <li>
                  <code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code>
                </li>

                <li>
                  <code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code>
                </li>

              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Error Message" class="slds-cell-wrap" style="vertical-align:top;" headers="d44322e41 ">
              <p style="margin-bottom:0;">
                <samp>Provided federation ID could not be found, or the account or user
                  is not properly configured for SSO</samp>
              </p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d44322e44 ">
              <p style="margin-bottom:0;">Either the user or the account security settings are configured incorrectly. Make
                sure that SSO is activated in the account security settings. Also, make sure that
                a user is configured in the account that has SSO enabled and has a Federation ID
                value that matches the Federation ID value contained in the SAML message.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Error Message" class="slds-cell-wrap" style="vertical-align:top;" headers="d44322e41 ">
              <p style="margin-bottom:0;">
                <samp>Your IP address (###.##.###.###) doesn't match the address recorded when the
                  session was established.</samp>
              </p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d44322e44 ">Turn off IP tunneling and cycling IPs for your VPN and try again.</td>

          </tr>
        </tbody>
      </table>