W-22513829-authorization-error-eme-dm

modules/ROOT/pages/exp-home-start.adoc

@@ -37,6 +37,9 @@ Access and Credentials::
 +
 * Confirm that you have a user account for your organization's entry path, such as Anypoint Platform, and valid credentials to log in.
 * Confirm that you can reach the new experience and integrated services, such as Anypoint Platform, or a connected coding assistant, from the networks and locations you use.
++
+[NOTE]
+If your organization has set the Connected App Authorization Policy to *restricted*, an administrator must add the MuleSoft Omni app to the allowlist before users can access the enhanced experience. This is a one-time action per organization. See xref:exp-troubleshoot.adoc#cant-authorize-app-error-for-organizations-with-restricted-connected-app-policy["Can't Authorize App" Error] for details.
 
 Platform and Product Access::
 +

modules/ROOT/pages/exp-troubleshoot.adoc

@@ -65,6 +65,47 @@ Some actions require specific service states (such as active or registered).
 Some features might be in preview or require specific product access.
 .. Ask your administrator about feature availability if needed.
 
+[[cant-authorize-app-error-for-organizations-with-restricted-connected-app-policy]]
+=== "Can't Authorize App" Error for Organizations with Restricted Connected App Policy
+
+If you see a "Can't Authorize App" error when attempting to access the enhanced MuleSoft experience:
+
+. Understand the cause:
++
+This error occurs when your organization's *Connected App Authorization Policy* is set to *restricted*.
++
+.. By default, newly created organizations have this policy set to *unrestricted*, which allows users to access connected apps without additional approval.
+.. When the policy is set to *restricted*, it indicates that your administrator has intentionally configured this security setting to control which connected apps can access organizational data.
+.. This restricted policy takes precedence over any application allowlisting configured on the MuleSoft side.
++
+For more information about Connected App Authorization Policies, see xref:access-management::connected-apps-org-admin.adoc#configure-authorization-policies[Configure Authorization Policies].
+
+. Contact your administrator:
++
+Only an administrator can resolve this issue. Regular users can't add apps to the allowlist.
++
+.. Inform your administrator that the MuleSoft Omni app needs to be added to your organization's allowlist.
+.. Provide them with the error message screenshot if helpful.
+
+. Administrator resolution steps:
++
+If you are an administrator:
++
+.. When the "Can't Authorize App" error appears, click the *Go to add the app to allowlist* button.
+.. Complete the authorization flow to add MuleSoft Omni to your organization's allowlist.
+.. This is a *one-time action* that applies to the entire organization.
++
+After completing this step, all users in the organization will be able to access the enhanced MuleSoft experience without encountering this error.
+
+. Verify resolution:
++
+If you continue to experience issues after your administrator has added the app to the allowlist:
++
+.. Clear your browser cache and cookies.
+.. Verify that you're signed in with the correct organizational account.
+.. Confirm that your network connectivity is functioning properly.
+.. Contact your organization's Anypoint Platform administrator for additional assistance.
+
 == Connection Failures
 
 Connection failures prevent you from connecting providers, running scanners, or accessing external systems.