diff --git a/src/Foundation/Instances.hs b/src/Foundation/Instances.hs
index 39b8ee163..5513bc424 100644
--- a/src/Foundation/Instances.hs
+++ b/src/Foundation/Instances.hs
@@ -140,12 +140,17 @@ instance YesodAuth UniWorX where
       plugins <- getsYesod authPlugins
       AppSettings{..} <- getsYesod appSettings'
 
-      when appSingleSignOn $ do
-        let plugin = P.head $ P.filter ((`elem` [apAzureMock, apAzure]) . apName) plugins
-            pieces = case oauth2Url (apName plugin) of
-                      PluginR _ p -> p
-                      _ -> error "Unexpected OAuth2 AuthRoute"
-        void $ apDispatch plugin "GET" pieces
+      when appSingleSignOn $
+        let azurePlugins = P.filter ((`elem` [apAzureMock, apAzure]) . apName) plugins
+         in if
+              | (plugin:_) <- azurePlugins
+              , PluginR _ p <- oauth2Url (apName plugin) -> do
+                $logInfoS "SSO" "Azure plugin with plugin url as expected. Calling apDispatch..."
+                void $ apDispatch plugin "GET" pieces
+              | not (null azurePlugins) -> do
+                $logErrorS "SSO" "Azure plugin initialized, but unexpected oauth2Url. Cannot apDispatch."
+              | otherwise -> do
+                $logErrorS "SSO" "No Azure plugin initialized despite SSO being enabled!"
 
       toParent <- getRouteToParent
       liftHandler . defaultLayout $ do