Resolving the Entra ID AADSTS75011 error during SAML SSO [Linux]
Summary: mrs7jq provides a detailed guide on resolving the AADSTS75011 error encountered during Microsoft Entra ID SAML SSO with Sisense. This error occurs when Entra ID rejects Sisense's authentication request if it requires a different level of security, such as MFA or Windows Hello. To fix the issue, they recommend changing the PassAuthnContext parameter to false within Sisense's SSO settings using the REST API 0.9. The guide walks through accessing Sisense as an Administrator, choosing the correct API version, applying the configuration payload, and verifying the change. The solution aims to allow Entra ID to authenticate users according to their organization's policies, resolving mismatch errors effectively. They advise testing the solution in the user's environment before full deployment. If further assistance is needed, the author encourages reaching out.
Introduction:
Experiencing the AADSTS75011 error during Microsoft Entra ID SAML SSO? This occurs when Entra ID rejects Sisense's password authentication request in favor of MFA or Windows Hello. Learn to update your SSO configuration to prevent this mismatch. Applies to all recent versions, Cloud and On-Premises.
Step-by-Step Guide:
When Sisense performs a SAML authentication request by default, it includes the RequestedAuthnContext parameter, which specifically asks Entra ID to authenticate the user using a standard Password method. If your users authenticate with higher-security methods (like Windows Hello, MFA, FIDO2, or certificate auth), Entra ID rejects the mismatch and throws the AADSTS75011 error.
To resolve this, you must set the PassAuthnContext parameter to false in Sisense's SSO settings. This tells Sisense to omit the strict authentication context, allowing Entra ID to authenticate the user based on your organization's security policies.
Step 1: Access the REST API Explorer
Log in to Sisense as an Administrator.
Navigate to Admin → REST API via the left-hand menu.
Description: The Sisense Admin page with the REST API tab highlighted in the left navigation pane.
Step 2: Switch to API Version 0.9
To ensure this specific system setting change persists properly in the database, you must use version 0.9 of the API.
At the top of the API Explorer page, locate the version selector.
Change the selection from 1.0 (or v1) to 0.9.
Step 3: Apply the Configuration Payload
Scroll down and click on the POST /settings/sso endpoint to expand it.
Click the Try it out button.
In the body parameter field, paste the following JSON payload exactly as shown below:
Click Execute.
Description: The expanded POST /settings/sso endpoint showing the JSON payload in the request body and the Execute button.
Step 4: Verify the Change
Check the Server Response section directly below the Execute button. You should receive a 200 OK response code, indicating the system setting was successfully updated. Once applied, users should no longer receive the AADSTS75011 error. (Note: Users experiencing cached redirects may need to clear their browser cache and cookies for "All time" if the error temporarily persists).
Conclusion:
By updating the PassAuthnContext flag to false via the 0.9 REST API, Sisense stops enforcing a specific authentication method in its SAML payload. This resolves the AADSTS75011 mismatch error and allows Microsoft Entra ID to successfully process MFA, certificate, or passwordless logins seamlessly.
References/Related Content :
How to generate a HAR file with sensitive data (Windows/Linux) - Useful if further SAML troubleshooting is required.
Disclaimer: This post outlines a potential custom workaround for a specific use case or provides instructions regarding a specific task. The solution may not work in all scenarios or Sisense versions, so we strongly recommend testing it in your environment before deployment. If you need further assistance with this, please let us know.
