Follow a sign-in
Open Company SSO with your work email. After sign-in, choose the eligible instance or return to the authorized link you opened. Successful company sign-in can therefore be followed by denied instance access. Check the selected instance, accepted provider, account state and provisioning policy before changing resource permissions.Know which credential you are using
OIDC discovery used while connecting a Vault integration is not the same as configuring company login. A successful Vault consent does not create a RevoEngine user, grant platform roles or authorize every Agent action.
Review instance authentication policy
Open Settings → General → Authentication to inspect accepted identity integrations. SSO and HYBRID instances require a non-empty accepted-provider policy. Hybrid availability does not make every alternate sign-in method valid for every user. Configure the external identity integration with your organization administrator and RevoEngine operator. The ordinary Settings screen exposes the effective instance policy; it is not a general-purpose OIDC provider-registration wizard. Use the current Config API contract for supported administration fields.
Review automatic provisioning as an access decision. Assigning a Permission group may grant capabilities; adding a Group may admit the new user to restricted data. Keep both sets minimal and verify the first created account.
Expected failures
For programmatic calls use API authentication. For revocation use account security.