The CESI ENT is the centralized digital portal of the CESI group that provides access to courses, administrative tools, and educational services. When the connection fails, the blockage does not always come from the platform itself: authentication goes through a SSO ADFS system hosted on sts.viacesi.fr, coupled with the Microsoft 365 ecosystem. Identifying the exact source of the problem allows for restoring access in a few minutes instead of multiplying unsuccessful attempts on the ENT homepage.
SSO ADFS and Microsoft 365: the authentication mechanism of CESI ENT that often blocks
The majority of CESI ENT connection failures do not occur on ent.cesi.fr, but on the organizational authentication page sts.viacesi.fr. This portal uses a SAML redirection to CESI’s SSO ADFS, meaning that the verified credentials are those of the Microsoft 365 account assigned by the school.
See also : How to request a prior declaration for paving your yard: steps and tips
An expired password on the Microsoft side blocks access to the ENT without an explicit error message. The user sees a generic login page, tries several combinations, and ends up temporarily locking their account.
Before any other manipulation, it is necessary to test the connection directly on portal.office.com with CESI credentials. If the connection also fails on Office 365, the problem is confirmed on the Microsoft account side, not on the ENT side. When this diagnosis is made, it becomes easier to resolve a CESI ENT connection issue by targeting the correct reset procedure.
Read also : How to Facilitate Access to Health Resources for Sector Professionals
CESI Password Reset: the procedure that avoids looping blockages
The classic reflex is to click on “Forgot Password” from the ENT page. This option redirects to the standard Microsoft procedure, which sends a verification code to the recovery address registered during account creation.
The CESI authentication portal also offers a direct link “Change Password” accessible on sts.viacesi.fr via the updatepassword page. This method works even when the ENT session refuses to open, as it acts directly on the federated identity layer, without going through the ENT interface.
Common errors during the reset
- Using a personal email address instead of the assigned CESI address (format [email protected] or variant depending on the cohort) causes a silent rejection of the form
- Not adhering to Microsoft’s password complexity policy (minimum length, special characters, prohibition of reusing old passwords) causes validation to fail without a clear explanation
- Attempting the reset from a browser that retains old ADFS authentication cookies in cache creates a redirection loop between sts.viacesi.fr and the ENT
To bypass this last case, opening a private browsing window remains the quickest solution. It forces the browser to establish a clean session with the ADFS server.
CESI ENT Connection and Browser Cache: the technical settings that unlock access
The SSO coupling between the ENT and Microsoft 365 generates several session cookies and SAML tokens stored by the browser. When this data partially expires, the browser sends an outdated token to the authentication server, which rejects it and redirects back to the login page. The user ends up in a redirection loop without an exploitable error message.
Clearing the browser’s cache and cookies, specifically for the domains cesi.fr, viacesi.fr, and microsoftonline.com, interrupts this loop. On Chrome, the manipulation is done via privacy settings by filtering by site. On Firefox, the “Cookies and Site Data” section allows for targeted cleaning.
Extensions and antivirus that interfere with SSO
Some ad blockers or privacy extensions intercept SAML redirections between ent.cesi.fr and sts.viacesi.fr. The browser interprets the redirection as a third-party tracker and blocks it.
Temporarily disabling extensions like uBlock Origin, Privacy Badger, or similar allows you to check if one of them is causing the issue. Software firewalls or antivirus with HTTPS filtering (Kaspersky, Bitdefender) can also alter the SSL certificates of the authentication chain. Adding sts.viacesi.fr and ent.cesi.fr to the HTTPS filtering exclusion list resolves this type of blockage.
Account not provisioned on Moodle CESI: distinguishing a real blockage from an access not yet activated
A specific case concerns students who access the CESI ENT without issue but cannot open Moodle CESI. The ENT and Moodle are two distinct services with separate account bases. An account may exist on the ENT side without being provisioned in Moodle yet.
Moodle CESI has a personal data management tool (“Data privacy”) that centralizes the status of accounts. If an account does not appear in the Moodle configuration registry, it means that provisioning has not yet taken place, and not that the credentials are incorrect.
In this situation, contacting the CESI IT support of one’s campus remains the only option. Attempting to create an account manually on Moodle CESI does not work: accounts are created by synchronization with the organizational directory.
When to contact CESI IT support and what information to prepare
After testing the connection on Office 365, clearing the browser cache, and attempting the password reset via sts.viacesi.fr, a persistent blockage falls under technical support. Each CESI campus has an IT service reachable by email or through the internal portal.
To expedite processing, the message should include the CESI identifier used, the browser and its version, a screenshot of the exact error message, and mention of the prior reset attempt. Specifying whether the blockage concerns the ENT or Moodle saves time for support, as the two platforms fall under different technical teams.
The prior diagnosis via Office 365 remains the most discriminating step. A functional Microsoft account that does not pass on the ENT points to a SAML identity federation problem, which significantly narrows the scope of investigation for support.