What is an unresolved user?
An unresolved User is a User who has no valid way to log in to SpeakUp. Unresolved Users keep their account and data, but they cannot sign in until an Administrator resolves their access.
Unresolved status is a safeguard: SpeakUp never silently removes a User's access, and SSO setup is never blocked. Instead, Users who would be left without a login path are flagged so an Administrator can decide how to handle them.
When a User becomes unresolved
A User becomes unresolved in two scenarios.
Scenario 1: IdP or email domain removed without a password invitation
A User was authenticating via an Identity Provider. The Identity Provider or its email domain mapping is removed, but no password invitation is sent to the User. The User is no longer authenticated via SSO and has no valid password in SpeakUp either, they therefore become unresolved, even if password login is enabled for the organisation.
Scenario 2: Previous password user whose domain is not covered when SSO is enabled
A User was authenticating with a password. SSO is configured and enabled for the organisation, which automatically turns off password login. The User's email domain is not mapped to any Identity Provider, so they have no SSO path. When password login was disabled, their previous password was invalidated. They become unresolved.
Re-enabling password login alone does not resolve these Users. Because their previous password is no longer valid, they need to receive a new password invitation before they can log in again.
The check runs whenever:
- SSO is first configured with domain mapping.
- A mapped email domain is removed. Refer to How do I map email domains to an Identity Provider?.
- An Identity Provider is removed. Refer to How do I edit or remove an Identity Provider?.
- Password login is disabled while there are Users whose domain is not mapped.
How unresolved Users are surfaced
- Unresolved Users appear in the user overview with the status unresolved.
- The user overview can be filtered by unresolved status so you can see all affected Users at once.
- A warning banner is shown at the top of the user overview when unresolved Users exist, prompting you to take action.
What unresolved Users see at login
An unresolved User who tries to log in sees an error message explaining that their account has no active authentication method and that they should contact their Administrator.
How to resolve unresolved Users:
You have three options:
- Map the User's email domain to an Identity Provider: all Users in that domain are resolved automatically. Refer to How do I map email domains to an Identity Provider?.
- Enable password login and send password invitations: enabling password login alone is not sufficient, unresolved Users have no valid password. You must also send them a password invitation so they can set a new one. Refer to How do I enable/disable password login alongside SSO? and How do I resend an invitation email to a (new) User?
- Disable the affected Users individually: removes their access entirely.
- SSO setup is never blocked. You can complete configuration and handle unresolved Users afterwards at your own pace.
- A User who fixes their own email in the Identity Provider does not need to be re-invited; their account is preserved via the Identity Provider's stable user ID.