vCenter OIDC "Access Denied": Troubleshooting "Failed to find FSP" and Domain Collisions with Entra ID

Products

VMware vCenter Server

Issue/Introduction

Issue Entra ID OIDC authentication to vCenter succeeds (Entra returns an OIDC auth code; Entra sign-in log shows Success), but vCenter returns "Access Denied. Unable to authenticate the user."

Symptoms

vCenter syslog (SSO/trustmanagement) shows: Failed to find user [user@domain] from cn=customer,cn=VCIdentityProviders...
vCenter syslog (SSO/trustmanagement) shows: Failed to find FSP [user@domain] under cn=VCIdentityProviders...
Users/groups resolve in the Global Permissions picker, but login fails at the Foreign Security Principal (FSP) resolution step.

Environment

VMware vCenter Server 8.0 Update 3 and higher

Azure VMware Solution (AVS)

Microsoft Entra ID (formerly Azure AD) Native OIDC Federation

Cause

The issue occurs when the authenticated OIDC user is not found as a Foreign Security Principal (FSP) in the vCenter Identity Service container. This typically happens if:

The user has not been successfully provisioned via SCIM 2.0.
SCIM provisioning is scoped to a group, but the individual member user has not yet been pushed to vCenter.
A domain collision exists where the same domain is configured as both an OIDC source and a legacy LDAP source.

Resolution

Verify SCIM Provisioning: Ensure the Entra ID Provisioning Agent has successfully pushed the user object to the vCenter SCIM endpoint.
Check Group Membership Scoping: If SCIM is scoped to specific groups, verify that the individual user is a direct member and that the Provisioning Agent has completed a full sync cycle for that user.
Resolve Domain Collisions: Ensure the domain (e.g., example.com) is not configured as a legacy Identity Source. If it is, remove the legacy source via Remove-ExternalIdentitySources (AVS environments) or the vCenter UI. Because AVS restricts cloudadmin permissions in the vSphere UI, legacy identity sources must often be removed using the Remove-ExternalIdentitySources Run Command.

Additional Information

End User Computing (EUC) transition to Omnissa
The "Access Denied" error message shows it is from Workspace One, and that product is now handled by Omnissa. Please open a case with Omnissa if you have tried the above steps and are still seeing the error.

If your SCIM logs show a successful push but you still receive this error, you may be experiencing a claim mismatch, which is covered in separate Broadcom documentation. This article specifically addresses missing FSPs and Domain Collisions.

KB 322179: Configuring Microsoft Entra ID for vCenter Server	The Primary Setup Guide: This is the main configuration article detailing how to set up the OIDC Enterprise App, SCIM 2.0 provisioning, and exact attribute mappings required for Entra ID to successfully federate with vCenter.
KB 416480: vCenter "Access Denied" Error After Entra ID OIDC	Claim Mapping Mismatches: Differentiates itself by focusing on the `externalId` vs `oid` attribute mapping failure. It resolves issues where vCenter ignores the user because the Entra ID Enterprise App is sending the wrong unique identifier claim.
KB 440496: vCenter 9.0 login fails with "Access Denied" when Entra ID	Premature Syncing / VCDB Corruption: Focuses on vCenter 9.0 issues where users are synced via SCIM before OIDC attribute mapping is finished, causing the vCenter Database (VCDB) to initialize users with default mapping values. The fix involves temporarily reverting to Embedded SSO to flush the SCIM data.
KB 409564: Login to vCenter Server with Entra ID user fails with USER_NOT_FOUND	Group Removal/Re-add Stale IDs: Addresses a very specific edge case where a user is removed from an Entra ID group and later re-added. Entra sends a new `ExternalId`, but vCenter's database still holds the old, immutable `ExternalId`, resulting in a mismatch.
KB 429082: Multi-Factor Authentication (MFA) configuration for vCenter Server	MFA Conditional Access: Explains that vCenter cannot natively prompt for MFA over OIDC, and differentiates itself by providing the exact steps to configure Microsoft Entra ID Conditional Access Policies to enforce MFA during the vCenter login redirect.
KB 370574: Could not create indirect identity provider	Stale Configuration Cleanup: Focuses on backend cleanup using SSH. It resolves errors encountered when trying to recreate an Entra ID OIDC identity provider after previously switching back to Embedded SSO, leaving stale config objects in the database.