Why didn't a new SSO user get an account automatically?

Why this happens

Automatic account creation is off by default. Cyberlop only creates an account on first sign-in when you tick Create accounts automatically on first sign-in on Settings → Single sign-on. Without it, a new person needs an account set up by an admin.

Even with the box ticked, three conditions must hold. The person's identity provider must sign them in with a verified email. The email must sit on one of the allowed domains you listed. And your plan must have a free user seat.

How to fix it

1. Open Settings → Single sign-on and tick Create accounts automatically on first sign-in.
2. Fill in the allowed-domains field that appears once you tick the box. Use the domain of your company email addresses.
3. Click Save single sign-on settings.
4. Confirm your identity provider marks the person's email as verified and that it ends in an allowed domain.
5. Check Settings → Plan & usage for a free seat under Users.
6. Ask the person to sign in again.

The first-sign-in rule matters too. If Require an admin-bound SSO subject has a tick, the new person still needs an admin to set their subject before they can enter.

Still not working?

Cannot find the domains field? It stays hidden until you tick the box. Read why the allowed-domains field is missing. For the setup in full, see letting new people get accounts automatically.

If seats are the problem, your account manager can help, or write to us via the contact page.

Related questions

• How do I let new people get accounts automatically through SSO?
• Why can't I find the allowed-domains field in the SSO settings?
• Why can't a new SSO user sign in for the first time?
• What does "Require an admin-bound SSO subject" do?
• How do I set up single sign-on with my identity provider?

Full tutorial

Single sign-on: set up OIDC, the redirect URI and account binding

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre