Overview
When accessing Team Dynamix, Banner, MyUI, and other applications, you may see this error message: The signed in user 'jvandal@uidaho.edu' is blocked because they are not a direct member of a group with access.
Example error message
Example of full error message:
Example Application Name
Sorry, but we're having trouble signing you in.
AADSTS50105: Your administrator has configured the application Example Application Name ('00000000-0000-0000-0000-000000000000') to block users unless they are specifically granted ('assigned') access to the application. The signed in user 'jvandal@uidaho.edu' is blocked because they are not a direct member of a group with access, nor had access directly assigned by an administrator. Please contact your administrator to assign access to this application.
Image of similar error message:
Resolution
User accounts can be marked as individual(opens in a new tab) or non-individual(opens in a new tab) account types. Individual accounts may be used to sign in to services like Banner, while all non-individual accounts are blocked. This is because many non-individual accounts have shared passwords.
If your individual account is getting this error message you will need to contact IT Local Support and ask to have your account marked correctly as an individual account.
IT Support
For support agents, this attribute is changed in Toolbox while editing the "Active Directory" account. Select the "individual" selection under "Account Type" and save. This change will take up to 4 hours to propagate to all services.
Cashier's Office secondary accounts
Warning: Do not set a Cashier's Office secondary account as individual. The correct fix is to set ExtensionAttribute13 to override the individual UDCID while leaving the account non-individual.
Cashier's Office secondary accounts are an exception to the resolution above. These accounts stay non-individual, but they still need to sign in to SSO applications. To allow that, the account must have ExtensionAttribute13 set so it overrides the individual UDCID.