Sign-on using the account badge when registered from Google SSO is sending the wrong param to google SSO

Question

Sign-on using the account badge when registered from Google SSO is sending the wrong param to google SSO

James Finch 0

I have setup Entra ID to be used for an App and configured Google SSO successfully. However, when the user tries to sign back in and is given the badge list of previously signed on users and attempts to use that method to sign back in I get an error. Entra attempts to send over the information to Google for SSO but passes the wrong params and Google comes back with an error. This does not happen when I choose to "use a different account" and directly login with Google SSO from Entra's flow using the "sign in using google" button.

If this patch is already in progress could someone link it to me so I can follow it please.

Rukmini 30,890 Reputation points Microsoft External Staff Moderator

2026-02-26T12:21:54.3866667+00:00
Hello James Finch, Due to session reuse during federated sign-in, this behavior is expected.

Microsoft Entra ID uses stored session hints (such login_hint) to attempt a silent/optimized authentication when users choose an already-logged-in account from the account picker. This can occasionally lead to Google receiving different parameters, which makes the IdP reject the request.

It works because choosing "Sign in with Google" or "Use a different account" initiates a new authentication request.

Please verify:

Google Cloud Console has the necessary redirect URIs set up correctly.

The Client ID and Secret in Entra precisely match Google

The necessary scopes are set up (openid, email, profile).

As of now, there is no known product patch specific to this behavior. Usually, it has to do with setup or sessions.
Rukmini 30,890 Reputation points Microsoft External Staff Moderator

2026-02-27T03:33:28.13+00:00

Hello James Finch Following up to see if the above provided information was helpful. If you have any further queries do let us know.

1 answer

Your answer

Rukmini 30,890 Reputation points Microsoft External Staff Moderator

2026-02-26T12:21:54.3866667+00:00

Hello James Finch, Due to session reuse during federated sign-in, this behavior is expected.

Microsoft Entra ID uses stored session hints (such login_hint) to attempt a silent/optimized authentication when users choose an already-logged-in account from the account picker. This can occasionally lead to Google receiving different parameters, which makes the IdP reject the request.

It works because choosing "Sign in with Google" or "Use a different account" initiates a new authentication request.

Please verify:

Google Cloud Console has the necessary redirect URIs set up correctly.

The Client ID and Secret in Entra precisely match Google

The necessary scopes are set up (openid, email, profile).

As of now, there is no known product patch specific to this behavior. Usually, it has to do with setup or sessions.
Rukmini 30,890 Reputation points Microsoft External Staff Moderator

2026-02-27T03:33:28.13+00:00

Hello James Finch Following up to see if the above provided information was helpful. If you have any further queries do let us know.

Answer 1

It seems that the issue you are experiencing with the sign-on using the account badge is related to the parameters being sent to Google SSO from Microsoft Entra ID. When using the badge list for sign-in, the parameters may not be matching what Google expects, resulting in an error. This issue does not occur when using the "sign in using Google" button directly, which suggests that the flow for badge sign-in may need to be reviewed or adjusted.

Unfortunately, the context provided does not mention any specific patches or updates related to this issue. For further assistance, I recommend checking the Microsoft Entra documentation or reaching out to Microsoft support for guidance on this specific problem. They may have insights or updates regarding this behavior and any ongoing fixes.

References:

Share via

Sign-on using the account badge when registered from Google SSO is sending the wrong param to google SSO

1 answer

Your answer