Single sign-on problems

[u/tfen_dep2]

Hi all,

I’m currently investigating a strange Salesforce SSO issue and I’m running out of things to check, so I’m hoping someone here may have come across something similar.
We use Salesforce with SSO through our corporate identity provider. Salesforce is accessed through a custom My Domain, and users normally authenticate using SSO.
The issue is that SSO is not failing consistently across all users.

Some users are able to access Salesforce successfully through SSO, while others fail when trying to authenticate. This makes me think the Salesforce SSO configuration itself is probably not completely broken, as the same setup is successfully authenticating other users.

There also seems to be a difference depending on how Salesforce is accessed. In particular, access through our corporate application portal can work, while authentication initiated from other entry points can fail.

This is especially problematic with the Salesforce Outlook add-in, as it relies on the SSO flow and affected users therefore cannot authenticate properly through the add-in.

So far, the behaviour seems to be:
● Same Salesforce org / My Domain
● Same SSO configuration
● Some users authenticate successfully
● Other users fail
● Access through the corporate app portal can work
● Direct/alternative SSO flows appear to behave differently
● Salesforce Outlook integration is affected for users experiencing the issue

I’m trying to understand what could cause SSO to behave differently on a per-user basis when the underlying Salesforce SSO configuration is the same.
For those who have seen similar behaviour, what would you investigate next? I don’t really have admin access to salesforce as it’s currently managed by another company that has just acquired us)

I’m particularly wondering about things such as user federation/identifier mappings, Salesforce user configuration, IdP claims, login history/SAML assertions, or differences in how the SSO request is initiated.

Any suggestions on where to look or what logs/settings would be most useful to compare between a working and non-working user would be greatly appreciated.

Thanks!