The sign-in page ignores what you typed and offers a different address
We cleared the credential store, the saved passwords, the device management profile and the mail app. All four were empty. The old address kept appearing anyway.
A user types their address into a sign-in box. The page accepts it, then signs them in as somebody else, or offers an older address they no longer use. Deleting the account from the app and adding it again changes nothing. Reinstalling the app changes nothing.
The instinct is that the device is holding a cached credential, so you go looking for it. On a laptop that means the credential store. On a phone it means saved passwords, the mail settings, the device management profile. We checked all of them and every one was empty.
What is actually happening
Nothing is cached in the app. What exists is a live signed-in session with the identity provider, held as a cookie. The order of events is not what it looks like:
- The user submits the address they typed.
- The identity provider checks for an existing session before doing anything with that address.
- It finds one, and signs them into that instead.
What the user typed is discarded at step two. That is why typing it more carefully never helps, and why the problem survives a reinstall: the session does not live in the application.
The one-minute test
Sign in from a private or incognito window. A private window carries no cookies and no single sign-on state, so it is a clean read of what the account actually does.
- Works in private, fails elsewhere. The account is fine. It is a session. Stop looking at the device.
- Fails in private too. The account itself is wrong, and no amount of device work will help.
This one test splits the problem in half and costs nothing. Do it before anything else, not after an hour on the phone.
The fix
Sign out at the identity provider, not in the application. Most have a dedicated logout URL that terminates every session that browser holds. Then sign in again.
Applications from the same vendor share one sign-on store on a phone, so the session survives deleting any single app as long as a sibling is still installed. Signing out of one of the others often clears it.
The general shape
Whenever a system appears to ignore an input, check whether something earlier in the chain is short-circuiting before that input is ever read. The input is not being overridden. It is not being reached.
And a diagnostic habit worth keeping: when several plausible theories all come back empty, that is not bad luck. It is a signal that the fault is not in the layer you are searching.
Need help with any of this?
These notes are free and always will be. If you would rather someone just set it up, or you are stuck on something similar, get in touch at hello@opsira.io.