We are attempting to configure Single Sign On in our Salesforce Marketing Cloud sandbox. We already have SSO set up in Production.
We noticed that when we configure SSO in sandbox, the SSO in production breaks. We can't seem to be able to have both working at the same time.
We have enabled TSE (Tenant-Specific SP EntityID ) in Marketing Cloud sandbox (new feature) to be able to have a different Entity Id for this instance. In Azure, we have created a new app specifically for sandbox.
When either of the connection breaks and a user tries accessing the app via SSO, they are presented with the following error:
"SSO Fatal Profile ErrorIncoming SAML message is not properly formatted, or has elements which are missing or invalid. Message was signed, but signature could not be verified."
According to this link https://help.salesforce.com/s/articleView?id=sf.mc_overview_saml_error_resolution.htm&type=5, the reason indicates that the system could not validate the signature contained in the message with the certificate data contained in the identity provider metadata configured with the account.
We have checked the certificates and they match.
We have raised a case with helpdesk but have not have any luck so far. Has anyone experienced a similar issue when setting up SSO for 2 different MIDs who could shed some light on this?