In this case, you probably didn’t change the values of the SsoAppUserGroup and SsoAppAdminGroup in the default SettingsFileGenerator.xml, and your site has different user groups for SSO.
Could not enlist orchestration...
This can happen when you forget to change the default PortBindingsMaster.xml file. The setup gives you a valid PortBindingsMaster.xml file, but it practically empty. You need to export your Bindings either directly to this file, or massage your Bindings file and add your desired substitutional variables that can be set by the SettingsFileGenerator.xml file.
Filed under: Deployment