'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix Zendesk SAML SSO Redirecting to JSON Login in Microsoft My Apps
Question details
The user needs to troubleshoot a Zendesk SAML single sign-on configuration that redirects to a JSON login page when accessed via the Microsoft My Apps portal.
- Product
- Microsoft Entra ID (Zendesk SSO)
- Device & OS
- not provided
- Scenario
- Launching Zendesk through the Microsoft My Apps portal using SAML SSO.
- Observed behavior
- The SSO configuration works correctly through a direct link, but redirects the user to an unexpected JSON login page when launched from the Microsoft My Apps portal.
Ensure you have administrator access to both your Microsoft Entra ID (formerly Azure AD) portal and your Zendesk admin center to review SSO configurations and reply URLs.
Verify Microsoft Entra ID Application Configuration
Check the SAML settings in Microsoft Entra ID to ensure the Reply URL and Sign-on URL are correctly formatted for Zendesk's Identity Provider-initiated login.
When an application works via a direct link but fails from the My Apps portal, it usually indicates a mismatch between Service Provider-initiated (SP-initiated) and Identity Provider-initiated (IdP-initiated) SSO settings.
Log in to the Microsoft Entra admin center as a Cloud Application Administrator.
Navigate to 'Identity' > 'Applications' > 'Enterprise applications' and select your Zendesk application from the list.
Click on 'Single sign-on' in the left menu and click 'Edit' in the Basic SAML Configuration section.
Ensure the 'Reply URL (Assertion Consumer Service URL)' exactly matches the expected Zendesk SSO URL provided in Zendesk's SAML setup documentation.
Verify that the 'Sign-on URL' is configured correctly. For IdP-initiated SSO from the My Apps portal, leaving this blank or explicitly setting it according to Zendesk's Entra ID guide is required to prevent incorrect routing.
Consult Entra Community and Support Teams
Escalate the issue to specialized support channels if the SAML configuration appears correct but the JSON redirect persists.
Looking for a simpler workspace? Try WPS Office
While you are troubleshooting complex enterprise integrations like Microsoft Entra ID and SAML SSO, you can simplify your daily document management with WPS Office. It provides a lightweight, comprehensive productivity suite that requires minimal configuration and operates seamlessly across all your devices.
- 1. Download the Installer: Visit the official WPS Office website to download the free installer for your operating system.
- 2. Install WPS Office: Run the downloaded file and follow the straightforward on-screen instructions to complete the installation.
- 3. Start Creating: Open WPS Office to immediately start creating, editing, and managing your Office documents without complex logins.
Frequently Asked Questions
Why does my SAML SSO work from a direct link but fail from Microsoft My Apps?
Direct links typically use Service Provider (SP)-initiated SSO, while clicking the app in the My Apps portal uses Identity Provider (IdP)-initiated SSO. If the application's Basic SAML Configuration in Entra ID (like the RelayState or Sign-on URL) is misconfigured for IdP flows, the login will fail or redirect incorrectly.
What does it mean when Zendesk redirects to a JSON login page?
A JSON redirect usually indicates that the SAML assertion was not formatted correctly, or Zendesk is interpreting the incoming login request from the Identity Provider as an API call rather than a standard web browser login session.
How can I capture a SAML trace to troubleshoot login issues?
You can use browser extensions like SAML-tracer or the network tab in your browser's developer tools (F12). Start recording, reproduce the login error, and then inspect the SAML request and response payloads to identify missing or incorrect attributes.
