When an Identity Provider selects an incompatible Assertion Consumer Service binding during IdP-initiated SSO (for example, when a Sign-on URL is also configured), users encounter a generic "Invalid SAML Response: Missing SAMLResponse parameter" error with no indication of the underlying cause.

Suggested: Add a validation check during SSO connection testing that detects common ACS binding mismatches and surfaces a specific, actionable message (for example, suggesting removal of the Sign-on URL) instead of a generic SAML response error.

Customer Benefit: Speeds up self-service troubleshooting for SSO login failures for a configuration issue that already has a known cause and fix.