Connecting an AI app is refused: connectors are off, 2FA is missing or the request is invalid

What you see

On the Connect an app page (the consent page an assistant such as Claude or ChatGPT sends you to):

• A yellow alert "Your organization has not turned on AI connectors. An administrator can allow them under Settings > Organization." and the Allow button greyed out, with the same text on hover. If the switch is turned off while the page is open, pressing Allow brings up the same alert and greys the button out. Deny still works.
• The heading "Set up two-factor authentication first", with "Your organization requires two-factor authentication. Turn it on for your account, then start the connection again from the app." and a Set up two-factor authentication button.
• The heading "This connection request is not valid", with either "This app is not registered with NirmaanOne; start the connection again from the app" or "The app asked to return to an address it did not register", and "For your safety you are not sent back to the app. Start the connection again from the app; you can close this page."
• The heading "Could not load this connection request" with the error underneath and a Try again button.

On AI connectors (Settings):

• A yellow alert "AI connectors are turned off for your organization, so new connections cannot be made and existing ones stop working." followed by the link Turn them on in Organization settings if you can edit the organization, or "Ask an administrator to allow them." if not.
• On the All connections in your organization card, the note "Revoking another user's connection needs permission to update organization settings." and the same text on hover over the greyed-out Revoke icon.

Inside the assistant, a connection that used to work starts failing; the assistant reports its own error, because every request it makes is refused with "AI connectors are turned off for this organization" or "The user signed out everywhere or changed their password; connect again". If it says "The user has not verified their email address; the connector works again once it is verified", see Sign-in refused: verify your email address.

Why it happens

• AI connectors are an organization-level switch, off by default. Until an administrator turns on Allow AI connectors (MCP) under Settings > Organization, nobody in the organization can allow a connection, and turning it off later stops every existing connection at its next request. This keeps company data out of assistants until the organization has decided to permit them.
• The two-factor policy applies to the consent page. When the organization requires two-factor authentication and your account has none, the consent page refuses like every other page (see Pages refuse to load data: your organization requires two-factor authentication). A connected assistant acts as you, so it cannot be allowed by an account that does not yet meet the policy.
• The request must come from a registered app. The page is opened by the assistant with the details of the app and the address it wants to return to. If the app is not registered with NirmaanOne, or the return address is not one it registered, the page refuses and deliberately does not send you anywhere. Any other failure (for example the server not responding) shows "Could not load this connection request".
• A connection belongs to your sessions. Using Sign out everywhere on My Profile, changing or resetting your password, or an administrator resetting your two-factor authentication ends every connection made before that moment, the same way it signs out your browsers. The assistant keeps failing with "The user signed out everywhere or changed their password; connect again" until you connect it again.
• Revoking someone else's connection is an administrator's act. You can always disconnect your own assistants under Your connections. Revoking a connection in the organization-wide list needs the Edit permission on Organization Settings; with only the View permission you see the list but the Revoke icon is greyed out.

How to fix it

1. Connectors are off. An administrator (the Edit permission on Organization Settings) opens Organization settings, turns on Allow AI connectors (MCP) and, in the "Allow AI connectors?" dialog, presses Allow AI connectors. The toast reads "AI connectors are now allowed."
2. Start the connection again from the assistant. The consent page does not refresh on its own; the assistant opens a fresh request, which now loads with Allow available.
3. Two-factor authentication is required. Set it up on My Profile (the Set up two-factor authentication button on the consent page takes you there), then start the connection again from the assistant.
4. The request is not valid. Start the connection again from the assistant. If it keeps failing, the assistant's connector is set up with the wrong details: remove it and add it again with the MCP server URL shown on AI connectors.
5. The request could not be loaded. Press Try again. If it still fails, check your connection and sign-in; if you were signed out, the page sends you to sign in and brings you back to the same request.
6. The connection stopped after signing out everywhere or a password change. Connect the assistant again from the assistant, and allow it on the consent page.
7. You cannot revoke another user's connection. Ask an administrator with the Edit permission on Organization Settings to revoke it from All connections in your organization, or ask the user to press Disconnect under their own Your connections.

Related

• Connect an app
• AI connectors
• Organization settings
• My Profile
• Pages refuse to load data: your organization requires two-factor authentication
• Sign-in refused: verify your email address