“App Not Assigned” Chromebook adding new user error

A ward in our stake recently received a new Chromebook to replace their old PC. So far, most ward leaders who have attempted to add an account to the device using their Church account have been getting the following error when trying to log in and make their account:

403
App Not Assigned
Sorry, you can't access SAML - Chrome OS Workforce KB0080696 because you are not assigned this app in Okta. If you're wondering why this is happening, please contact your administrator.

This is followed by a “Go to Homepage” button that takes them to the ChurchOfJesusChrist.org web home page within the account creation pop-up window.

So far:
Two users have been successful:

• One bishop without Two-Step Verification enabled on his account

• One stake technology specialist WITH Two-Step Verification enabled on his account.

Various other users have NOT been successful:

• Counselors in the bishopric

• Ward clerk

• Doesn’t seem to matter whether they have Two-Step Verification enabled or not

Is there something special that needs to be done to configure a user’s Church account to allow them to log into a new Chromebook to create their Chromebook account?

Thanks in advance!

Just a curious question: What email service provider is listed in their Church Accounts for those having success and those not having success?

jdlessley wrote: Sun Oct 08, 2023 2:16 pm Just a curious question: What email service provider is listed in their Church Accounts for those having success and those not having success?

Interesting thought. I have seen how some email providers or email forwarding services seem to treat Church notification emails differently. So this was a good suggestion to investigate.

Unfortunately, as far as I can tell from the listings under the Member Tools app, all of the users in this sample are using the same email service provider. So, unless there’s some unique configuration related to each user’s email, I’m guessing there is still some other differentiator between the successful and non-successful users.

According to a rep. with the Global Service Center, the issue we experienced with creating user accounts on new Chromebooks is related to both roles/callings and Multi-Factor Authentication (MFA).

As far as roles/callings go, only certain callings are permitted to create user accounts on the Chromebooks. This seems to match with what is listed at https://tech.churchofjesuschrist.org/wi ... mebook_FAQ. It it strange to me that counselors in bishoprics are not included in the callings that can add accounts. One bishopric counselor wondered if we could pass that along as feedback for improvement in the system.

Apparently, the other issue is that MFA (also known as two-step verification on the Church account setup page) is enforced. But it only seems to be enforced for certain callings. I haven’t experimented with this yet. But it appears to match the data set we have so far. Non-bishops that have been successful in adding user accounts to Chromebooks so far have all had MFA enabled on their accounts.

Hopefully, this will be helpful to others. And if anyone else can help verify this information, that would be appreciated.

I feel like this is a potential downside to adoption of Chromebooks in local units. Personally, I’m still in favor of the Chromebooks. If I’m not mistaken, I believe they are both less expensive to purchase and easier to maintain and manage centrally when compared to traditional desktop PCs. I also think the portability of the devices is a potential plus in some cases. So I’m hoping that issues like these can be overcome or improved so that we don’t unnecessarily slow down the adoption of new technologies that I think will help add value to the Church’s approach to technology.

aslade wrote: Mon Oct 09, 2023 9:12 am It it strange to me that counselors in bishoprics are not included in the callings that can add accounts.

While they have access to information, in many cases they're not allowed to modify it. (For example, membership records)

I'd have to review the rules of financial authorization to see if there's a case where two councilors may need to cut a check. Otherwise, there'd be someone there who does have access.

Still, this does prevent them from printing reports.

So the church is now issuing laptops instead of desktop computers?

RyanGard1977 wrote: Thu Oct 12, 2023 1:33 am So the church is now issuing laptops instead of desktop computers?

If the Chromebook option is chosen when it's time for computer replacement.

RyanGard1977 wrote: Thu Oct 12, 2023 1:33 am So the church is now issuing laptops instead of desktop computers?

We were supposed to get a choice. Our FM Group sent PCs without asking us what we wanted.

Additional follow-up on this topic.

• It does seem like Bishops in our stake are not having trouble with logging on and creating accounts on local unit Chromebooks

• Some Assistant Ward Clerks have not had luck with being able to use their Church account to log on and create a local account on their ward Chromebook. Enabling MFA/2FA on their Church does not seem to make a difference in this case.

Has anyone else zeroed in on the necessary settings for Assistant Ward Clerks to be able to log in on a Chromebook? One specific example I can think of is an Assistant Ward Clerk whose calling in Member Tools is showing as “Ward Assistant Clerk--Finance.” Does that leader also need to have a separate calling designation of “Ward Assistant Clerk” that isn’t narrowly specified as being for Finance in order to gain permission to use their Church account to log on to the ward Chromebook? Or is there some other aspect of their Membership Record that is not quite right? They obviously have access to the Finance area of LCR. But something else is preventing them from getting permission to fully use the ward Chromebook.

Thanks in advance for your insights.

The FAQ says, Anyone using the GUEST account can open and use any of the Church provided websites like LCR using their Church Account. Is this not correct? Or does this not allow access to other things on the ward Chromebook that they desire to use?

lajackson wrote: Mon Nov 06, 2023 5:02 pm The FAQ says, Anyone using the GUEST account can open and use any of the Church provided websites like LCR using their Church Account. Is this not correct? Or does this not allow access to other things on the ward Chromebook that they desire to use?

You are correct. Users can still use the Guest account to access LCR. The disadvantage to the Guest account is that additional apps (e.g. Member Tools), preferences, and local file storage are not available options. Everything gets reset when the user is done. That’s not a problem for many users. But it could be a detriment to frequent users. For example, display preferences, including for external displays, for optimal comfort, convenience, and efficiency would need to be set every time the user logs in. Normally not a big issue. But when a clerk and a counselor have family and/or other members to attend to, being as efficient as possible when processing donations every week can mean a world of difference.

For this reason, I’m also at a loss to fully understand why Bishopric/Branch Counselors are not included in the list of users who can create a local profile/account. I would imagine some counselors may also benefit from the added features available only to users with a local profile/account.

Update:
It seems that some users may not have their accounts automatically updated in all the right databases to gain the expected permissions for regular access to Chromebooks according to their callings. My understanding is that a manual process to correct this can be requested. Start by contacting the Global Service Center and they can create a ticket to have it processed by another team.
It’s not entirely clear to me who may be affected by this scenario. But it may have to do with the timing of when the individual was called. I’m wondering if perhaps scripts to synchronize the relevant databases may have been offline during some periods. So new callings to positions that should normally be authorized for this might have been missed, I’m guessing.