“Our sandbox was recently refreshed. Production uses SSO. We are unable to log in to the refreshed sandbox using username/password, and the Forgot Password function returns: ‘Your account isn't set up yet. Your Salesforce admin can help with that.’ Please reset the password for the Sandbox System Administrator so we can access the sandbox without SSO.” Even admin's also unable to login.
#Sandbox
Hi Lakshman,
This is a documented Salesforce behavior, not a config mistake on your side. When a sandbox is refreshed, SAML/SSO settings are copied over but automatically disabled, because the Recipient URL changes to match the new sandbox URL, and the sandbox Org ID also changes with every refresh, which invalidates the existing SSO configuration. That's exactly why username/password and Forgot Password both fail right now, if your users were SSO-only, they never had a local Salesforce password set up in the first place, so there's nothing for Forgot Password to reset, hence "Your account isn't set up yet."
Official reference:
https://help.salesforce.com/s/articleView?id=000385851&type=1To get back in, try these in order:
1. Log in directly with local credentials (bypassing SSO):
Go to
https://test.salesforce.com(or your Sandbox My Domain URL)
Username:
user@domain.com.sandboxnamePassword: whatever password was active in Production at the exact time of the refresh (sandbox refresh carries over the Production password as of that moment)
2. If another admin already has direct access to the sandbox:
Have them go to Setup > Users inside the sandbox, remove the ".invalid" suffix from your email, save, then click Reset Password on your user record.
3. If every single admin is locked out (sounds like your case):
Open a case with Salesforce Support from your Production org. Provide the Sandbox Org ID and explicitly request a password reset email for the affected Sandbox administrator. Support can issue this even though Forgot Password self-service fails.
Once you regain access as admin:
4. Go to Setup > Identity > Single Sign-On Settings (Lightning) or Setup > Security Controls > Single Sign-On Settings (Classic)
5. Click Edit, check SAML Enabled, Save
6. Update the Recipient URL to match the new sandbox URL, then download the sandbox's SAML metadata and send it to your Identity Provider so they can update their config to the new sandbox URL and Org ID
Until step 6 is done, SSO simply will not work in this sandbox, that part isn't a bug, it's expected after every refresh.