IKJ56420I: User ID not authorized to use TSO

What it means

IKJ56420I shows up on the logon screen as soon as TSO looks up the user ID you typed. Before TSO asks for a password, it checks two things with the security system (usually RACF). The ID has to exist, and it has to carry TSO logon details. In RACF those details sit in the TSO segment of the user profile. They include the default logon procedure, the account number and the region size. If the ID is missing, or the TSO segment is missing, TSO stops here. A system that still keeps TSO users in the older UADS data set checks that list instead, with the same result.

Your password isn't the problem. TSO hasn't checked it yet. A wrong password gives a different message, IKJ56421I.

The I at the end of the message number stands for informational. Nothing is waiting for your reply. The same ID gets the same result until the security setup changes or you connect to the system where the ID is defined.

Common causes

• A typing slip in the user ID, such as a zero in place of the letter O, or an extra character.
• You're connected to the wrong system. Many sites run separate test, development and production systems, each with its own RACF database. A new ID is often added to one before the others.
• The ID is new and the security team created it without a TSO segment. This is common when an ID was first set up for batch work, CICS or a web application.
• The ID was deleted after a long period without use, or its TSO segment was removed after a change of role.

How to find the problem

1. Read the user ID inside the message. It shows exactly what TSO received, so a typo or a stray character is easy to spot.
2. Check which system you reached. The welcome screen before logon (often called the USS or VTAM screen) or the session settings in your emulator show the host and the application name, such as TSO, TSOA or TSOPROD. Compare that with the system where your ID was requested.
3. Ask the help desk to have a security administrator look the ID up with LISTUSER PAYU07 TSO. If the ID doesn't exist on this RACF database, RACF answers with ICH30001I UNABLE TO LOCATE USER ENTRY PAYU07. If it exists, the output shows whether there is a TSO segment.
4. The administrator can also check whether the ID is revoked. A revoked ID needs a reset, not a TSO segment, so it's worth ruling out at the same time.

How to fix it

• Retype the ID carefully and make sure you're on the right system.
• If the ID isn't set up, raise a request with the help desk. Include the full message, the system or application name you used, and when you last logged on successfully.
• The security administrator adds the TSO segment, for example ALTUSER PAYU07 TSO(ACCTNUM(ACCT01) PROC(IKJPROC) SIZE(65536)), using the account number and logon procedure your site uses.
• If the site protects logon procedures and account numbers with the TSOPROC and ACCTNUM classes, the administrator also has to give the ID access to the chosen procedure and account. Without that, the logon fails at the next stage.
• If your ID is eight characters, it can't be used for TSO at all, because TSO user IDs are one to seven characters. TSO rejects an eight-character ID with a different message, IKJ56710I INVALID USERID. Ask for a seven-character ID for TSO work.

What it looks like

LOGON PAYU07
IKJ56420I USERID PAYU07 NOT AUTHORIZED TO USE TSO

Last reviewed 2026-10-12 by the WND Software team. Written in our own words. For the full reference, check IBM’s documentation for your z/OS, CICS or Db2 release.