3/10/2026 3:09 PM

3/10/2026 3:09 PM

When testing SAML SSO using Settings → All Settings → SAML Configuration → Test Configuration, or when logging in via the LOGIN WITH ENTRAID SSO button:

• The SAML Configuration Test Result shows:

  • SAML Authentication is configured properly, but cannot log in to SolarWinds Platform!

  • SAML Authentication failed!

  • The partner identity provider https://sts.windows.net/<tenant-guid>/ is not configured.

• Additional details from the test:

  • User Name: N/A

  • Groups: N/A

• The SAML Response includes:

  • Destination / ACS URL:
    https://<SolarWindsHost>/Orion/SamlLogin.aspx

  • Audience:
    https://<SolarWindsHost>

  • Issuer (IdP):
    https://sts.windows.net/<tenant-guid>/

  • NameID:
    user@domain.tld

  • OrionGroups claim present with group GUID values

Despite apparently correct URLs and claims, the login fails and no user/group mapping occurs.

Orion Platform

SolarWinds SAML configuration treats the Identity Provider as a “partner identity provider” identified by its entity ID / Issuer. This value must exactly match the Issuer in the incoming SAML assertion.

In this case:

• Microsoft Entra ID sends the Issuer in the SAML response as:

  https://sts.windows.net/1d2ebba5-c586-43bc-9f41-b94a93f6cf51/
  

• In Settings → All Settings → SAML Configuration → Identity Provider, the SolarWinds configuration had a different IdP entity ID, for example:

  • A value with:

    • Missing trailing slash, or

    • Extra space at the beginning or end, or

    • A slightly different URL (e.g., login endpoint vs. Issuer), or

    • An older/stale value left from a previous configuration.

Because of this mismatch, when SolarWinds receives the SAML Response and attempts to look up the IdP configuration by Issuer, it cannot find a matching partner identity provider and throws:

The partner identity provider https://sts.windows.net/<tenant-guid>/ is not configured.

Important points:

• The error occurs before user mapping:

  • User Name: remains N/A

  • Groups: remains N/A

• The problem is not with:

  • NameID format,

  • OrionGroups claim itself, or

  • The SAML individual / group accounts (those can be correct and still fail if the IdP entity ID does not match).

Step 1 – Confirm the Issuer from Entra ID

1. In the SolarWinds Web Console, run:
   Settings → All Settings → SAML Configuration → Test Configuration.

2. Complete the test so the SAML Configuration Test Result shows the SAML Response.

3. In the SAML Response, locate the Issuer element, for example:

   <Issuer>https://sts.windows.net/1d2ebba5-c586-43bc-9f41-b94a93f6cf51/</Issuer>
   

4. Copy this Issuer value exactly, including the trailing slash.

Step 2 – Update the Identity Provider entity ID in SolarWinds

1. In the SolarWinds Web Console, go to:
   Settings → All Settings → SAML Configuration → Edit Identity Provider.

2. In the Identity Provider details, find the field labeled something like:

   • Identity provider entity ID, or

   • Issuer, or

   • IdP Entity ID.

3. Replace the existing value with the Issuer copied from the SAML Response, for example:

   https://sts.windows.net/1d2ebba5-c586-43bc-9f41-b94a93f6cf51/
   

4. Ensure there are no extra spaces before or after the URL, and that the trailing slash is present if it appears in the SAML Response.

5. Save and finish the wizard.

Optional (recommended): Import IdP metadata from Entra

Instead of manually typing the entity ID, you can let SolarWinds pull the correct values from Entra:

1. In the Entra enterprise application used for SolarWinds SSO, open the SAML configuration.

2. Copy the App Federation Metadata URL.

3. In SolarWinds SAML Configuration → Identity Provider, use the option to import IdP metadata from URL, paste the metadata URL, and let SolarWinds populate the IdP details (including entity ID and certificate).

4. Save and finish the wizard.

Step 3 – Re-test SAML configuration

1. In SolarWinds, go to:
   Settings → All Settings → SAML Configuration → Test Configuration.

2. Test with a known user, with the format user1@domain.net.

3. Verify in the SAML Configuration Test Result:

   • The SAMLConfigurationException
     The partner identity provider https://sts.windows.net/... is not configured
     no longer appears.

   • User Name now shows the user’s NameID (e.g., user1@domain.net).

   • If SAML individual or group accounts are properly configured, the test should complete successfully and the user should be able to log in via LOGIN WITH ENTRAID SSO on the Login page.

Step 4 – Verify other users

1. Ask additional users assigned to the Entra enterprise application to:

   • Browse to the Web Console, for example:
     https://<SolarWindsHost>/Orion

   • Click LOGIN WITH ENTRAID SSO.

   • Confirm they are redirected and logged in successfully.

2. If a specific user still fails:

   • Check their NameID in the SAML Test Result.

   • Ensure:

     • A matching SAML individual account exists for that NameID, or

     • The user is a member of an Entra group emitted in the OrionGroups claim and that group has a corresponding SAML group account in SolarWinds.

---

Notes / Related

• This issue was confirmed and resolved in an environment running SolarWinds Platform 2026.1 (NPM 2026.1) with Microsoft Entra ID as IdP.

• Additional environment warnings like:

  • WCF HTTP Activation not enabled, or

  • “Check site bindings (Website Health) – None of the SolarWinds Platform website bindings match DB entry”

  may appear in diagnostics but are not the root cause of the specific “partner identity provider is not configured” SAML error. They should still be addressed separately via Configuration Wizard and Windows Features where appropriate.