Cannot log in via SSO subdomain: "You are not yet a member of this organization"

Problem

Logging in to Qodana Cloud through an organization's SSO subdomain (<name>.qodana.cloud) fails with:

Access Denied
You are not yet a member of this organization. Please contact the organization owner to request an invitation.
If you believe this is an error, verify your organization configuration and try again.

The error appears even for users who are already members, admins, or owners of the organization when logging in with a regular JetBrains Account.

Cause

Identities created through SSO subdomain logins are separate from regular JetBrains Account logins. Organization membership via SSO is granted only to users who have a qodana-* role (qodana-owner, qodana-admin, qodana-editor, or qodana-viewer) assigned on the organization's JetBrains Hub instance. Existing organization membership from a regular login does not carry over to the SSO identity, so a user without a Hub role is rejected as a non-member.

Resolution

Assign a Qodana role in JetBrains Hub to every user who should log in via SSO:

1. In Qodana Cloud, open Settings | SSO | Configure SSO. This opens the organization's JetBrains Hub instance. See Managing users and auth modules in Qodana Cloud SSO.
2. In Hub, assign a role such as qodana-admin to each affected user.
3. Retry the login through the SSO subdomain.

Only organization Admins and Owners can configure SSO. SSO requires the Ultimate Plus plan (includes trial)