Applicable plans: ❎ The free plan, ❎ The complete plan

When opening the Waldo application, you may see the message:

“WALDO – Let the magic begins…” 
and when you click the button, you are asked again for consent, even though your internal IT has already granted it. This issue is usually related to the Microsoft Entra ID (Azure AD) SAML configuration.

Why this happens

Waldo uses Microsoft Entra ID for secure authentication. In the Waldo Enterprise Application settings, there is an option called Assignment required. When this option is enabled, only users who are explicitly assigned to the Waldo application are allowed to complete the login process. If a user is not assigned, the authentication may succeed, but the user will not be redirected back to Waldo, resulting in the loading screen.

Waldo recommended configuration

Waldo recommends keeping the Assignment required setting disabled. This configuration provides the most reliable login experience while still ensuring that only authorized users can access Waldo.

What happens when Assignment required is disabled

When Assignment required is set to No, users can sign in with their Microsoft account. Waldo will only grant access to users who already exist in Waldo and are synchronized through the Employee Directory Connector (EDC). Users who are not synchronized will see an Access Denied message. If Guest mode is enabled, those users may instead be logged in as guest users. This setup avoids login blocks and prevents users from being stuck on the loading screen.

What happens when Assignment required is enabled

When Assignment required is set to Yes, users must be manually assigned to the Waldo Enterprise Application. Users who are not assigned may successfully authenticate with Microsoft, but they will remain blocked and see the “WALDO – Let the magic begins…” message. It is also important to note that Microsoft Entra ID does not support nested groups for this setting, meaning only users directly added to the assigned group will be able to log in.

How to resolve the issue

To resolve this issue, an administrator should open the Microsoft Entra admin center, go to Enterprise Applications, select Waldo, open the Properties section, and set Assignment required to No. After saving the changes, users should be able to access Waldo normally.

If the issue persists, please contact your IT administrator and ask them to review the Waldo SSO configuration in Microsoft Entra ID. If you continue to experience problems after this review, please open a support ticket with Waldo Support and include a brief description of the issue.