Tenant mismatch, missing scope, or the caller is acting under a support-access impersonation session (impersonation-operation-forbidden). The last is a DISTINCT cause and not an authorization failure — the operator holds admin.tenant.idp.override and is inside the tenant boundary. Deleting the provider UNBINDS every account bound to it: both federation columns are cleared, a password change is required and every live session is revoked, so a third party inside a consent window can take the tenant's sign-in down and no later re-declare undoes it. Declaring the authentication path is denied; destroying it is denied on the same ground. It binds on SaaS deployments only (PRD §148). Branch on type, not on the status.

Not found. Also returned for a provider belonging to another tenant or to the deployment scope — oracle-safe.

The deletion would leave the tenant with no account able to sign in. Unbinding does not restore a usable password, so a tenant whose ACTIVE accounts are all federated would have no in-product login. The detail names the affected tenants; create or activate a local administrator in each, then retry.