Users are failing to login using single sign on  and the following error is generated in the DMZ_WEB log 

Error Code: 4330
Message: Failed to sign on: SAML assertion did not list this organization as a valid audience

The following error is displayed in the DMZ_WEB log 

Line 129351: 2022-11-08 14:17:13.577 #60 z50 ---------- SAML SSO Binding Handler starting ----------
    Line 129352: 2022-11-08 14:17:13.577 #60 z50 Binding type: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
    Line 129371: 2022-11-08 14:17:13.670 #60 z60 BindingHandler.AuthenticateSAMLResponse: SAML response has no InResponseTo attribute; likely an IdP-initiated signon attempt
    Line 129384: 2022-11-08 14:17:13.686 #60 z60 SAMLAuthenticator: Decoded and verified assertion
    Line 129419: 2022-11-08 14:17:13.702 #60 z60 SILUser.ExecuteAuthenticators: Authenticating user 'XXXXXX' with authenticator: SAML Assertion Authenticator
    Line 129420: 2022-11-08 14:17:13.702 #60 z60 SAMLAuthenticator.AllowedByConditions: Checking current time 2022-11-08T19:17:13.7028578Z against assertion valid time range (2022-11-08T19:07:13Z to 2022-11-08T19:27:13Z) with skew allowance 00:02:00
    Line 129421: 2022-11-08 14:17:13.702 #60 z30 SAMLAuthenticator.AllowedByConditions: Service Provider entity ID ( https://<hostname>/XXXX/) was not listed in assertion allowed audiences
    Line 129422: 2022-11-08 14:17:13.702 #60 z30 SILUser.ExecuteAuthenticators: User 'XXXXXX' unable to authenticate with authenticator: SAML Assertion Authenticator; continuing authentication chain
    Line 129450: 2022-11-08 14:17:13.702 #60 z60 Hash for logtime=2022-11-08T14:17:13 action=sec_signon instid=XXXX username=xxxxxxxxxxxxxx ipaddress=<IP address> error=4330 agentbrand=Chrome Browser agentversion=107.0.0.0 message=Failed to sign on: SAML assertion did not list this organization as a valid audience resilnode=1 interfacetype=10 prevhash=6230e78bdd8ea6d506678b199e72c2be1128da07  is 707f32e856f7ba232c6fc6cb46827937276e31d4

The Service provider (MOVEit Transfer) Identifier (Entity ID) in the SAML response from the Identity provider is invalid  because (in this particular case)  there is a leading space in the base URL set in the MOVEit Transfer Config Utility, which is replicated into the service provider's (MOVEit Transfer) metadata file. This is causing the SAML Response to include a SAML audience that is invalid due to the leading space replicated in the SAML audience XML entry in the SAML response. Basically in a SAML response from the identity provider, the service provider Identifier (Entity ID) URL will be seen with a leading space in front of the URL, causing the error.

Another issue can be the base URL of MOVEit Transfer having a trailing forward slash character. For example if it is set to https://test.progress.com/ it should actually be  https://test.progress.com, clear the training / from the url. Carry out an IIS reset and have the metadata.xml exported to Okta.

This indicates a mismatch between the Audience URL(Entity ID) given by MOVEit during the SAML configuration and the Identity Provider. In Okta Audience URL(Entity ID)  values must match exactly.
Audience URL(Entity ID) of:
https://test.progress.com/1234 may fail with the error in this article however https://test.progress.com/123/ will allow authentication to succeed
 

1. Open the MOVEit Transfer Config Utility, click on the Paths tab, locate the base URL entry and remove any leading spaces present or other unexpected characters. Then click Apply to save the settings.
2. Perform an IIS reset (in elevated command prompt, enter: iisreset).
3. Download a fresh metadata file from MOVEit Transfer and upload to the identity provider or use the metadata URL link to download the file into the Identity provider.
4. Test the Single Sign-on.

References to Other Documentation:

MOVEit Transfer 2026 Administrator Guide > Admin/Web UI > Settings > Security Policies > Troubleshooting Single Sign-on Issues
https://docs.progress.com/bundle/moveit-transfer-web-admin-help/page/Troubleshooting-Single-Sign-on-Issues.html

Progress Articles:
Is it possible to require multi-factor authentication (MFA) for SFTP or FTP logins?
MOVEit Transfer - SSO Error: (Failed to sign on: Unable to verify SAML assertion signature: No valid signing certificate found in Identity Provider configuration)