Common mistakes

1 min read · Chapter 9 of 10

What usually goes wrong

Symptom	Likely cause	First thing to check
One customer sees another's data	An endpoint checks login and skips ownership	The shared permission function and two-tenant tests
A former employee still uses the app	SSO without SCIM, or tokens and keys not revoked on deactivation	What a SCIM deactivation actually revokes
A whole customer can't sign in on Monday	Its SAML certificate rotated, or "SSO required" went on with no break-glass admin	Certificate dates and the connection's error log
Account taken over despite MFA	A phished code, a stolen session cookie or a help-desk reset	Recent recovery events, new passkeys, session origins
Identity bill jumps with no new customers	Bot sign-ups counted as active users, or machine tokens not cached	The vendor's meter and token caching