Zendesk SSO Login Error (Redirected to Logout URL)

How to fix it

Try these in order — the most common fix is first.

1. 1. Update the certificate fingerprint

   Copy steps
   1. Get the new SHA2 fingerprint of the IdP certificate
   2. Admin Center > Account > Security > Single sign-on > SAML
   3. Replace the Certificate fingerprint and save
   Did this fix it? Yes No

2. 2. Check who SSO applies to

   1. In the same security settings, enable SSO for the right user group (team members vs end users)
   Did this fix it? Yes No

3. 3. Check IdP configuration

   Copy steps
   1. Entity ID https://<subdomain>.zendesk.com and ACS https://<subdomain>.zendesk.com/access/saml
   2. Confirm the user is assigned to the app and the email matches
   Did this fix it? Yes No

4. 4. Use a bypass login

   1. Try /access/normal to sign in without SSO if your settings allow it, then fix the config
   Did this fix it? Yes No

Symptoms

Users authenticate with SSO but land on the logout URL, 'Access denied' or 'This page doesn't exist'.

Why it happens

• IdP SSL certificate renewed so the SHA2 fingerprint no longer matches
• SSO enabled for end users but not team members, or the reverse
• Email in the IdP does not match the Zendesk profile
• User not assigned to the app in the IdP (for example Entra ID)
• Wrong Entity ID or ACS URL

This guide also covers

• zendesk sso login error
• zendesk saml redirect logout url
• zendesk access denied sso

Other Zendesk errors

• Zendesk Emails Not Creating Tickets
• Zendesk Triggers Not Firing
• Zendesk Email Notifications Not Sending
• Zendesk Web Widget Not Loading or Not Showing
• Zendesk Macros Not Working or Not Showing
• Zendesk API Errors 401, 422 and 429
• Zendesk Attachment Too Large or Upload Refused
• Zendesk AI Agent Not Answering