This article provides guidance for managing your Single Sign-On (SSO) setup in PandaDoc, including how to delete your SSO configuration and resolve common SSO-related errors.
Deactivating or deleting your SSO configuration
If you no longer want to use SSO with your PandaDoc account, you can remove the configuration depending on your account status.
If you still have an Enterprise plan:
Go to Settings > Single Sign-On.
Click the three-dot menu next to your SSO configuration.
Select Delete.
You can also refer to our SSO implementation article for step-by-step guidance.
If your account was downgraded from Enterprise:
You may not be able to remove the SSO configuration from the UI. In this case, our Support Team can help delete it.
Error: New user can’t join workspace
Issue: A new user sees an error when accepting an invitation to a workspace.
Reason: The account is SSO-only and the user has not yet signed in via the Identity Provider (e.g. Okta).
Solution: The user must first log in through your Identity Provider. This will create their account and assign them to the default workspace. After that, they can accept invitations to additional workspaces.
Error: “SAML Response Signature Validation Failed”
Reason: The x.509 certificate was either incorrectly submitted during setup or has expired.
Solution: Request a new x.509 certificate from your Identity Provider and update it in PandaDoc.
Error: “User is not configured for SSO”
Possible reasons:
SSO hasn’t been set up yet.
The user isn’t part of a group configured to access PandaDoc.
Solution:
If SSO isn’t set up yet, follow our SSO setup guide.
If access is limited to certain groups, ensure the user is added to an allowed group in your Identity Provider.
Error: “Unable to define user name”
Issue: You may see an error such as:
“No attribute 'FirstName' found”
“No attribute 'LastName' found”
“No attribute 'Email' found”
Reason: Mismatch between required user attributes on your IDP and PandaDoc’s expected format.
Solution: Make sure attributes like FirstName, LastName, and Email are correctly mapped and available in your IDP configuration. Refer to your IDP documentation (e.g. Microsoft Entra) for guidance.
Error: “User Provisioning Failed”
Reason: There are no available licenses in your account.
Solution: Check your account's license usage. If needed, purchase additional licenses so new users can be provisioned.
Error: 403 “app_not_configured_for_user”
Issue: The user encounters a 403 error when logging in.
Reason: SSO hasn’t been configured properly in Google Workspace or another provider.
Solution: Ensure you’ve completed SSO setup correctly. You'll need to provide the following info to your IT team:
For US-based customers:
Entity ID:
https://pandadoc.comACS URL:
https://app.pandadoc.com/sso-acs/
For EU-based customers:
Entity ID:
https://pandadoc.euACS URL:
https://app.pandadoc.eu/sso-acs/
Note: The Start URL is not required.
Error: “Unable to join workspace”
Issue: A user can’t join via an invite or link and sees an error indicating blocked access.
Reason: The account uses SSO. Direct login isn’t allowed without prior SSO authentication.
Solution: Make sure the user is added in your Identity Provider and directs their login through your SSO login page.
Need help?
If this article didn’t resolve your issue, reach out to PandaDoc Support by clicking Need help at the top right corner in your PandaDoc account > Live chat, then ask the chatbot to connect you with an agent. To help us assist you more quickly, please include any relevant error messages or screenshots.