The error "Sign in is not allowed" after Azure AD/Entra authentication usually means the user account does not exist in Phoenix and automatic sign-up is disabled. In the Helm chart or environment, check if `allow_sign_up` (or `PHOENIX_OAUTH2_MICROSOFT_ENTRA_ID_ALLOW_SIGN_UP`) is set to `false`. If so, an admin must pre-create the user in Phoenix before they can sign in via SSO. If you want users to be auto-provisioned on first login, set `allow_sign_up` to `true` for your identity provider configuration in the Helm chart or as an environment variable. See <https://github.com/Arize-ai/phoenix/pull/7582|this PR> and <https://github.com/Arize-ai/phoenix/blob/main/helm/values.yaml|Helm chart docs> for details.
Would you like step-by-step instructions for updating your configuration?
Sources:
- <https://github.com/Arize-ai/phoenix/pull/7582|feat!: allow a oauth2 only mode>
- <https://github.com/Arize-ai/phoenix/blob/main/helm/values.yaml|Helm chart docs>