Azure AD has issued a SAML token for another instance of the application with the identifier (EntityID) spn:(string). Delete the other instance or update the identifier (EntityID) value on the application side.

Question

Azure AD has issued a SAML token for another instance of the application with the identifier (EntityID) spn:(string). Delete the other instance or update the identifier (EntityID) value on the application side.

Samuel Purcell 36

Getting the following error when trying to integrate Okta and Azure. Okta is the SP in this scenario.

"Azure AD has issued a SAML token for another instance of the application with the identifier (EntityID) spn:f3c9ff37-1f6f-45ef-8ec1-e76841d2f31f. Delete the other instance or update the identifier (EntityID) value on the application side."

I have tried removing the Azure custom SAML 2.0 application and creating a new one. All of the metadata on both sides appears to be correct.

Is this issue in Azure or Okta and what do I need to change to correct it?

Rakesh Jagatap 11 Reputation points Microsoft External Staff

2021-10-08T18:13:43.847+00:00

Hi, if the posted answer resolves your question, please mark it as the answer by clicking the check mark. Doing so helps others find answers to their questions.

Accepted answer

0 additional answers

Your answer

Rakesh Jagatap 11 Reputation points Microsoft External Staff

2021-10-08T18:13:43.847+00:00

Hi, if the posted answer resolves your question, please mark it as the answer by clicking the check mark. Doing so helps others find answers to their questions.

Answer 1

AmanpreetSingh-MSFT 56,876 Moderator

Hi @Samuel Purcell • Thank you for reaching out.

This seems to be a configuration issue at Azure side. Could you please check below points:

Navigate to Azure Active Directory > Enterprise Applications > Search for the Okta app. If there are multiple instances of the servicePrincipal, please delete one of the instances from the directory. Also delete the associated Application objects under Azure AD > App Registrations, and click on delete permanently button under Deleted applications (Preview) tab of App registrations blade as well.
If there is only one instance of the application under Enterprise Applications blade, please make sure that there is an identifier (EntityID) is marked as default.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Samuel Purcell 36 Reputation points

2021-10-08T18:16:48.51+00:00

Thank you! Your #2 fixed the issue for us.
Technology Administrator 1 Reputation point

2022-03-07T11:47:58.987+00:00
Hi amanpreetsingh-msft,

I am having the same issue with an App, it is the only instance of the app in Enterprise Apps, and its EntityID is selected as default in the configuration, but still having the issue.

Would you have any other suggestion on how to find out what is the other instance that Azure AD is saying to be using the same value?

I searched using PowerShell, but it only returns me 1 matching app.

$AllAADApps = Get-AzureADApplication -All $true Foreach ($app in $AllAADApps) { if ($app.IdentifierUris -eq "http://www.<appname>.com") { Write-Host "-----------------------------------" Write-Host "DisplayName: "$app.displayname"" Write-Host "IdentifierUris: "$app.IdentifierUris"" Write-Host "" } }

Share via

Azure AD has issued a SAML token for another instance of the application with the identifier (EntityID) spn:(string). Delete the other instance or update the identifier (EntityID) value on the application side.

0 additional answers

Your answer