Confirm who is affected
One user or the whole team.
Ask for the exact error
A screenshot or error text helps.
Check the identity provider
Confirm the app is assigned to the user.
Check email matching
Make sure the email matches the account.
Offer a temporary route
Send a password reset if policy allows.
Confirm the fix
Ask them to test and reply.