We have one user who can't access the Carbon Black EDR server. They can log into Red Canary, but not the Carbon Black server. I look at the user list and they are not in there.
We have other users who are able to login, so it's not a problem with the server, just with this user.
Cause A: The user does not have a name set in Red Canary. The name field is used to provision the SSO account for authentication to the Carbon Black EDR server, and the login will fail it no name is set. The user will likely see a 500 server error when trying to pivot to the Carbon Black EDR server.
Cause B: The user does not have the appropriate role assigned for their profile.
A) The user will need to set a name by going to https://go.my.redcanary.co/users/edit.
B) Grant the EDR User or Responder (whichever is appropriate) to the user. See Understanding and assigning roles for more information.
If the user is still having issues, it may be helpful to logout of Red Canary, then log back in after setting the name/role.
It may also be useful to re-attempt the authentication using incognito mode in Google Chrome.