“App Not Assigned” Chromebook adding new user error

[aslade]

A ward in our stake recently received a new Chromebook to replace their old PC. So far, most ward leaders who have attempted to add an account to the device using their Church account have been getting the following error when trying to log in and make their account:

403
App Not Assigned
Sorry, you can't access SAML - Chrome OS Workforce KB0080696 because you are not assigned this app in Okta. If you're wondering why this is happening, please contact your administrator.

This is followed by a “Go to Homepage” button that takes them to the ChurchOfJesusChrist.org web home page within the account creation pop-up window.

So far:
Two users have been successful:

• One bishop without Two-Step Verification enabled on his account

• One stake technology specialist WITH Two-Step Verification enabled on his account.

Various other users have NOT been successful:

• Counselors in the bishopric

• Ward clerk

• Doesn’t seem to matter whether they have Two-Step Verification enabled or not

Is there something special that needs to be done to configure a user’s Church account to allow them to log into a new Chromebook to create their Chromebook account?

Thanks in advance!

[jdlessley]

Just a curious question: What email service provider is listed in their Church Accounts for those having success and those not having success?

[aslade]

Just a curious question: What email service provider is listed in their Church Accounts for those having success and those not having success?

Interesting thought. I have seen how some email providers or email forwarding services seem to treat Church notification emails differently. So this was a good suggestion to investigate.

Unfortunately, as far as I can tell from the listings under the Member Tools app, all of the users in this sample are using the same email service provider. So, unless there’s some unique configuration related to each user’s email, I’m guessing there is still some other differentiator between the successful and non-successful users.

[aslade]

According to a rep. with the Global Service Center, the issue we experienced with creating user accounts on new Chromebooks is related to both roles/callings and Multi-Factor Authentication (MFA).

As far as roles/callings go, only certain callings are permitted to create user accounts on the Chromebooks. This seems to match with what is listed at https://tech.churchofjesuschrist.org/wi ... mebook_FAQ. It it strange to me that counselors in bishoprics are not included in the callings that can add accounts. One bishopric counselor wondered if we could pass that along as feedback for improvement in the system.

Apparently, the other issue is that MFA (also known as two-step verification on the Church account setup page) is enforced. But it only seems to be enforced for certain callings. I haven’t experimented with this yet. But it appears to match the data set we have so far. Non-bishops that have been successful in adding user accounts to Chromebooks so far have all had MFA enabled on their accounts.

Hopefully, this will be helpful to others. And if anyone else can help verify this information, that would be appreciated.

I feel like this is a potential downside to adoption of Chromebooks in local units. Personally, I’m still in favor of the Chromebooks. If I’m not mistaken, I believe they are both less expensive to purchase and easier to maintain and manage centrally when compared to traditional desktop PCs. I also think the portability of the devices is a potential plus in some cases. So I’m hoping that issues like these can be overcome or improved so that we don’t unnecessarily slow down the adoption of new technologies that I think will help add value to the Church’s approach to technology.

[russellhltn]

It it strange to me that counselors in bishoprics are not included in the callings that can add accounts.

While they have access to information, in many cases they're not allowed to modify it. (For example, membership records)

I'd have to review the rules of financial authorization to see if there's a case where two councilors may need to cut a check. Otherwise, there'd be someone there who does have access.

Still, this does prevent them from printing reports.

[RyanGard1977]

So the church is now issuing laptops instead of desktop computers?

[russellhltn]

So the church is now issuing laptops instead of desktop computers?

If the Chromebook option is chosen when it's time for computer replacement.

[lajackson]

So the church is now issuing laptops instead of desktop computers?

We were supposed to get a choice. Our FM Group sent PCs without asking us what we wanted.

[aslade]

Additional follow-up on this topic.

• It does seem like Bishops in our stake are not having trouble with logging on and creating accounts on local unit Chromebooks

• Some Assistant Ward Clerks have not had luck with being able to use their Church account to log on and create a local account on their ward Chromebook. Enabling MFA/2FA on their Church does not seem to make a difference in this case.

Has anyone else zeroed in on the necessary settings for Assistant Ward Clerks to be able to log in on a Chromebook? One specific example I can think of is an Assistant Ward Clerk whose calling in Member Tools is showing as “Ward Assistant Clerk--Finance.” Does that leader also need to have a separate calling designation of “Ward Assistant Clerk” that isn’t narrowly specified as being for Finance in order to gain permission to use their Church account to log on to the ward Chromebook? Or is there some other aspect of their Membership Record that is not quite right? They obviously have access to the Finance area of LCR. But something else is preventing them from getting permission to fully use the ward Chromebook.

Thanks in advance for your insights.

[lajackson]

The FAQ says, Anyone using the GUEST account can open and use any of the Church provided websites like LCR using their Church Account. Is this not correct? Or does this not allow access to other things on the ward Chromebook that they desire to use?