Customer Issue

Users on communities that use a vanity URL, SAML SSO for Experience, and the Microsoft Teams integration cannot complete sign-in through the Teams desktop app. The user authenticates successfully with the identity provider, but the window then goes blank and sign-in never completes. Browser access and the Teams web app are not affected.

Rather than wait for them to fix the bug, we have released a mitigation for this bug, however, it involves additional configuration on your end as well as some coordination with Firstup Support.

Environment

• Microsoft Teams Desktop App (Windows and Mac) 

Workaround Summary

• Confirm the correct reply/Assertion Consumer Service (ACS) URL for your community.
• Update your identity provider and and inform Firstup.
• Agree on a time to enable the configuration flag.
• Plan how to roll back the change if necessary.

Determine Your Reply/ACS URL

The instructions below assume usage of Microsoft Entra ID.

The reply/ACS URL must use Firstup’s core address for the region where your community is hosted, rather than your vanity URL.

Firstup Support will provide the complete URL containing the correct <brand> and <program> values for your community.

Update Your Identity Provider

As Microsoft Entra supports multiple Reply/ACS URLs, you can take these steps at any time, either before or after contacting us.

1. Log in to your Entra admin portal.

2. Navigate to Enterprise applications → [their application] → Single sign-on and click Edit next to Basic SAML Configuration to land on this page.

   → Edit → Add reply URL → Save

3. Under Reply URL (Assertion Consumer Service URL), click Add reply URL
4. Paste the core Firstup Reply/ACS URL provided by Firstup Support.
5. Save the change.
6. Notify Firstup Support  and provide a screenshot of the above page so that we can verify the correct settings prior to enabling the configuration flag on our end. 

Note: Important: Change only the reply/ACS URL ending in /saml/acs. Do not change the Audience, Entity ID, or Identifier URL ending in /saml/metadata. The Audience or Entity ID must continue to use your vanity URL.

Test the Configuration

After both changes are complete, confirm that a user can sign in to Firstup through:

• A supported web browser.
• The Microsoft Teams web app.
• The Microsoft Teams desktop app.

In the Teams desktop app, the authentication window should close after sign-in and the Firstup experience should load successfully.

If users still see a blank window, confirm with Firstup Support that:

• The identity provider is sending the SAML response to the new core reply/ACS URL.
• The Firstup configuration has been enabled for the correct community and environment.
• The Audience or Entity ID still uses the vanity URL.

Roll Back the Change

Coordinate any rollback with Firstup Support.

If you added the core reply/ACS URL alongside the vanity URL, as recommended, Firstup can revert its configuration flag without requiring you to remove the additional URL.