> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Access Manager SSO tenant validation

> Access Manager documentation now records the SSO callback validation that binds the returned identity to the initiating tenant.

<Badge stroke icon="calendar-days" iconType="regular">August 18, 2026</Badge> <Badge stroke icon="file-code" iconType="regular">Documentation correction</Badge> <Badge color="red" size="lg" stroke icon="triangle-exclamation" iconType="regular">Action required</Badge>

## Affects

***

Teams that configure Access Manager SSO in a multi-tenant deployment.

## What changed

***

Before issuing tokens, Auth validates that the email returned by the identity provider resolves to the tenant that initiated the SSO flow. A missing email or an email that resolves to another tenant is rejected with the generic SSO failure response.

This is a documentation correction that records implemented behavior. It does not announce a runtime release.

## Impact

***

**Classification: Action required.** An identity provider that omits the email claim or returns an address for another tenant will not complete SSO login.

## What you need to do

***

<Steps>
  <Step>Verify that your identity provider returns an email for every SSO identity.</Step>
  <Step>Confirm that each returned email resolves to the tenant that initiated the login.</Step>
  <Step>Test the SSO callback flow for each configured tenant before the next production change.</Step>
</Steps>

### Deadline

Complete the verification before the next Access Manager SSO configuration or identity-provider change.

## Resources

***

* [Configure the Auth plugin](/en/platform/access-manager/auth-plugin)