Monitoring apps fail after enabling SSO (SAML/Entra ID)

[hamid]

Hi,

We're running Qlik Sense Enterprise on Windows, November 2025. Since IT enabled SSO (SAML) on the server, all monitoring apps (Content Monitor, License Monitor and Operations Monitor) fail to reload with the following errors.:

Content Monitoring --> Connection 'monitor_apps_REST_app' not found

License Monitor --> Connection 'monitor_apps_REST_license_user' not found

Operations Monitor --> Connection 'monitor_apps_REST_user_condensed

What we've already checked/tried, without success:

• The data connections (e.g. monitor_apps_REST_*) exist in the QMC, correctly named, no typo.
• No security rule has been added or modified since the SSO switch
• All apps have been exported and reimported but still failing identically on their respective monitor_apps_REST_* connections.
• Owner is INTERNAL\sa_repository (default, unchanged).
• Connection string uses the default pattern: provider=QvRestConnector.exe;url=https://localhost/qrs/license/useraccesstype/full;...;authSchema=ntlm;...
• Tested with an explicit port on the URL (:4243) — same error.
• Checked virtual proxies: we have Central Proxy (Default) (prefix mgmt, Authentication method = Ticket, Windows authentication pattern = Windows, this field is grayed out/system-managed) and Entra ID (SAML, no prefix). The default proxy already natively supports the Windows authentication pattern fallback, so it doesn't look like a virtual proxy/NTLM config issue.
• Temporarily created a dedicated virtual proxy (Windows-only, separate prefix) to isolate REST/API traffic from the SSO flow — same "Connection not found" error persisted, so we rolled it back.

Has anyone met this ? if you could help please

BR,

Hamid

[Levi_Turner]

A few thoughts:

• Connection Not found means that the user doing the reload does not have sufficient permissions to be able to view the required data connections
  • Potential Resolutions:
    • Run in QMC
      
      • If this is failing then you likely use impersonation for reload tasks (QMC --> Service Cluster --> Impersonation) since otherwise the executing user will be sa_scheduler who can see any asset in Qlik (Security rule named ServiceAccount).
    • Adjust security rules so your user can see the data connection in the Hub (if reloading from the Hub)
• You will need a dedicated Windows virtual proxy and you will want to adjust the path in the URL of the data connection to use the new virtual proxy
  • Before: provider=QvRestConnector.exe;url=https://localhost/qrs/license/useraccesstype/full;...;authSchema=ntlm;...
  • After: provider=QvRestConnector.exe;url=https://localhost/{virtual_proxy_prefix}/qrs/license/useraccesstype/full;...;authSchema=ntlm;...