About the login process

This is for:

System Administrator

Users must log in to access the Coveo Administration Console, the Coveo Merchandising Hub, the Knowledge Hub, and other resources such as Coveo Connect. Some Coveo-powered search interfaces also require users to log in, especially if the search results they return are sensitive.

This page explains the login process that users must follow once their Coveo administrator invites them to join an organization It provides an overview of the available login options, procedures for tasks such as switching identity providers, and troubleshooting guidance for common login errors.

Invitation email

When you add a member to a Coveo organization, they receive an invitation email. They must click the link in the email to log in and accept the invitation. This link expires after 31 days.

Coveo invitation email

Login options

Coveo login page Coveo relies on third-party identity providers to authenticate members. Coveo requires that its members to log in using an account with one of the following identity providers:

When clicking either Google, Microsoft, or Salesforce, members are prompted to enter their credentials. For example, here’s Google’s prompt:

Google login page

Logging in with a custom SSO

Coveo login SSO organization ID If you implemented a SAML SSO other than Google, Microsoft, or Salesforce, you must instruct members to click Log in with a custom SSO on the login page, and then enter the ID of the organization they want to access. You should also provide this ID to new members when adding them to your Coveo organization, but if you haven’t, a link allows them to get a list of the organizations they can log in to.

After a member’s first login, Coveo stores the organization ID in a cookie and automatically fills the Organization ID box next time.

Logging in with email

Coveo login with email The email option allows members to log in without an account with one of the supported identity providers. It’s mostly used by new members of Coveo, especially those starting a free trial.

The login flow is the following:

  1. On the login page, the member clicks Log in with email.

  2. The member provides their email address.

  3. Coveo sends them an email with a login link.

  4. When the member clicks this link, the Coveo Administration Console opens in a new browser tab. They’re automatically logged in.

  5. The next time the member needs to log in to Coveo, they repeat steps 1 to 4 with the same email address.

Tip
Leading practice

While convenient for getting started, email login isn’t the best long-term option. If ready to commit to a full Coveo license, you should switch to an SSO provider such as Google, Microsoft, Salesforce, or a custom SSO. SSO offers a faster, smoother, and more secure sign-in experience, and it scales better as your organization grows. See Benefits of switching to SSO for details.

Coveo administrators can also use email login as a "backdoor" for their single sign-on implementation.

Benefits of switching to SSO

If ready to commit to a full Coveo license, you should switch to using Google, Microsoft, Salesforce, or another SSO provider for a better experience in the long term. For example, if your company uses Okta for SSO, you should implement it in your Coveo organization and have all Coveo users log in with this option. The advantages of this change are the following:

  • Logging in becomes faster and smoother. If members are already logged in to the SSO on another web application, they don’t have to enter their password and are automatically let in. They don’t have to switch to their inbox and wait for Coveo’s email.

  • Relying on a single system to manage user access reduces the risk of unauthorized access. For example, if an employee logs in to Coveo with their personal email, they can still access Coveo after leaving your company if you don’t manually delete their identity in the Coveo Administration Console. However, if they access Coveo with a company-managed account, this account is typically deactivated as part of the employee offboarding process.

After login

After their first login as a member of the group they have been added to, the member must accept the invitation to join this group. They’re then redirected to the Coveo application or search page they wanted to access.

Joining a Coveo group

Moreover, if it’s the first time they’re logging in with these credentials, members receive an email asking to confirm their email address.

Switching to a different provider

Switching from an identity provider to a different identity provider is essentially adding a new organization member, and then removing the original one. This must be done even if the user receives Coveo login links to their Google, Microsoft, or Salesforce address.

  1. Add the user as a new member of your Coveo organization, selecting the new identity provider. Make sure to add them to the same groups as their original account to preserve their privilege set.

  2. Delete the user’s original membership.

Multiple accounts

You can add the same person to your organization more than once, either by using different identity providers, such as Google and Microsoft, or by using email aliases, like jsmith@domain.com and john.smith@domain.com. Coveo considers the two sets of credentials to be independent and can’t tell if they represent the same individual. As a result, these two accounts can be granted different privileges.

After you add a member to your organization, make sure they log in using the same identity provider and exact email address that you used to invite them.

Login page address

The URL of the login page can differ depending on the region and whether your Coveo deployment is HIPAA-compliant.

Region Login page URL

US

https://platform.cloud.coveo.com/login

US (HIPAA-compliant)

https://platformhipaa.cloud.coveo.com/login

Canada

https://platform-ca.cloud.coveo.com/login

Ireland

https://platform-eu.cloud.coveo.com/login

Australia

https://platform-au.cloud.coveo.com/login

Alternatively, you can use the following addresses and replace <ORG_ID> with the unique identifier of your Coveo organization:

  • <ORG_ID>.admin.org.coveo.com

  • <ORG_ID>.admin.orghipaa.coveo.com for HIPAA organizations

Coveo will redirect you based on your primary deployment region, as listed previously.

Troubleshooting

When trying to log in, members might encounter the following messages:

"You currently don’t have access to any organizations"

Context and symptoms

When trying to log in, the member sees the following message:

You currently don’t have access to any organizations.

The member’s credentials are valid, but don’t match any Coveo organization member.

Likely cause and resolution

Cause

This message can have one of the following causes:

  • The member isn’t using the right identity provider. The member’s profile is linked to a specific identity provider, such as Google or Microsoft, selected by their Coveo administrator.

  • The member isn’t using the correct Coveo URL. The URL to use depends on the region where the member’s Coveo organization is deployed.

  • The user isn’t a member of a Coveo organization. To be a member of a Coveo organization and log in, one must first be invited by their Coveo administrator.

Resolution

Depending on the cause, try the following:

  • If the member isn’t using the right identity provider, they should try logging in with the identity provider specified in the invitation email. If they’re still unable to log in, make sure that they have been granted the privileges required to access the desired pages of the Administration Console, including the privilege to view the organization (View access level on the Organization domain).

    Note

    Members attempting to log in as part of a course on Coveo Level Up+ must create a Coveo test organization and log in using the same identity provider and email address they used to log in to the training platform.

  • If the member isn’t using the correct Coveo URL, ensure that they’re using the login URL corresponding to their Coveo organization’s deployment region. For multi-region deployments, the login URL is based on their primary deployment region.

  • If the user isn’t a member of a Coveo organization, invite them as a member.

"Insufficient privileges"

Context and symptoms

When trying to log in, the member sees the following message:

Insufficient Privileges - You currently have insufficient privileges to access the Coveo Administration Console of the [OrganizationName] organization. Contact an administrator of the [OrganizationName] organization to change your privileges, or select an organization to which you have access through the Coveo Administration Console.

Likely cause and resolution

Cause

The member tried to log in to an organization that they don’t have the privilege to view.

Resolution

Grant the member the privilege to view the organization (View access level on the Organization domain).
Context and symptoms

When trying to log in, the member sees one of the following messages:

  • AADSTS90093: Does not have access to consent.

  • Need admin approval: Coveo needs permission to access resources in your organization that only an admin can grant. Please ask an admin to grant permission to this app before you can use it.

Likely cause and resolution

Cause

A Microsoft Office 365 global administrator disabled the ability for users to consent to third-party applications such as Coveo.

Resolution

An Office 365 global administrator can either:

  • Give admin consent to the Coveo application on behalf of all users.

  • Enable user consent to third-party applications. This alternative is less likely to be chosen, as global administrators tend to disable user consent to keep track of the applications allowed to access their Office 365 organization resources.

The process of having an Office 365 global administrator give consent to Coveo is the following:

  1. Add the Office 365 global administrator as a member of your organization and grant them the privileges required to edit groups. If you just created the organization with your Microsoft email address, you might need to ask the Coveo Support team to do it for you, as you won’t be able to log in.

  2. When logging in to Coveo, the global administrator is prompted to authorize the Microsoft organization users to use Coveo.

  3. Once they have logged in, the global administrator can add you as an individual member of the organization or create a group of Microsoft users.

Contact the Coveo Support team if the error persists.

"Salesforce OAuth Error"

Context and symptoms

When trying to log in, the member sees the following message:

We can’t authorize you because of an OAuth error. For more information, contact your Salesforce administrator.

OAUTH_APPROVAL_ERROR_GENERIC: An unexpected error has occurred during authentication. Please try again.

For example:

OAuth error | Coveo for Salesforce

The URL of the error page ends with error=invalid_client&error_description=app+must+be+installed+into+org.

Likely cause and resolution

Cause

The Coveo Connected Apps haven’t been installed in the user’s Salesforce organization.

Resolution

  1. Log in to Coveo using a Salesforce administrator account or a Salesforce user account with the Approve Uninstalled Connected Apps permission.

  2. When prompted to authorize access to the Coveo Connected App, click Allow.

  3. Install the Coveo Connected Apps that apply to your use case.