# SSO blocked user

1. The mock IdP now behaves like an enterprise Entra tenant with app assignment turned on. When a blocked user attempts SSO, the browser lands on an actionable identity-provider policy message instead of a silent dead end.
