Start your own test sign-in: open `url`, sign in at your identity provider, and come back to organization settings.

Organization admins only (403 organization_admin_required), on a browser session with a fresh proof in the x-50h-reauth header (401 reauth_required). It needs a person: API keys, connected apps and service accounts get 403 session_required. Every change is written to the organization's audit. The result lands on the connection (lastTest) and in the error log; the page you come back to has sso_test=ok or an error code.