Troubleshooting
A bulk import was rejected
Every validation message verbatim — and the four ways a bulk import reports success while silently doing nothing useful. Use invitations instead, and here is why.
For whoever runs IT9 min readUpdated
Knowledge base
Troubleshooting
Real symptoms with real causes, written around the error message you actually saw: enrolment, rotation, ingest, sign-in, webhooks and seats.
25 articles
Articles in Troubleshooting
Troubleshooting
A credential rotation failed
The exact sentence the console shows for each rotation failure, the technical detail per platform, and how to clean up when the target changed and the vault did not.
For whoever runs IT9 min readUpdatedTroubleshooting
A detection rule never fires
Six reasons a detection stays quiet, in the order to check them: shadow status, an unpopulated field, a missing data source, a suppression, a cooldown, and ingest.
For whoever runs IT9 min readUpdatedTroubleshooting
A discovery scan finds nothing
Whether that means you are clean or that nothing looked — and the four causes, starting with the two where an empty result is not a result at all.
For whoever runs IT9 min readUpdatedTroubleshooting
A locked-out tenant
Nobody in your organisation can sign in. The five ways that happens, which of them the platform refuses to let you cause, and which need an operator with database access.
For whoever runs IT10 min readUpdatedTroubleshooting
A log source is ingesting nothing
Token, endpoint, payload, tenant and rate-limit refusals when events are not arriving — plus why events can arrive perfectly and still raise no alerts.
For whoever runs IT9 min readUpdatedTroubleshooting
A privileged session will not start
Approval, policy, concurrency, MFA and gateway refusals when a session will not open, with the exact message for each, and the policy fields nothing reads.
For whoever runs IT9 min readUpdatedTroubleshooting
A SCIM request returns 401
Two messages, six causes, and one of them is a lower-case B. Plus the 500 that is not an outage and the two endpoints your provider will probe and not find.
For whoever runs IT8 min readUpdatedTroubleshooting
A user cannot sign in
Wrong password, inactive account, lockout, MFA, a policy rule, a network zone or the wrong region — each with the exact response you will see and the fix.
For whoever runs IT9 min readUpdatedTroubleshooting
A webhook is not arriving
Six causes in the order worth checking: an event type nothing emits, a header name you stopped reading, the signature, the URL, the timeout and the retry ladder.
For whoever runs IT11 min readUpdatedTroubleshooting
An API key returns 403 when you expect 200
Eight different refusals share two status codes. Read the body: each string means something different, and three of them are not about permissions at all.
For whoever runs IT10 min readUpdatedTroubleshooting
An endpoint stopped reporting
What Stale means, the 15-minute threshold behind it, whether anything actually notifies you, and the ordinary causes to rule out before the sinister one.
For whoever runs IT9 min readUpdatedTroubleshooting
An inline hook is not arriving, or times out
Six causes in order: the event nobody raises, the paused hook, the missing secret, the refused address, the five-second budget, and the fact that there are no retries.
For whoever runs IT9 min readUpdatedTroubleshooting
I enrolled MFA and now I cannot get in
Six causes in order of likelihood, the one where your recovery codes will not help you, and exactly what to ask an administrator for.
For whoever runs IT9 min readUpdatedTroubleshooting
Insufficient permissions
The 403 that will not tell you which permission was missing — how to work it out, plus two refusals that are wiring gaps you cannot fix.
For whoever runs IT9 min readUpdatedTroubleshooting
MFA enrolment problems
Invalid codes, clock drift, already-enrolled errors and the two endpoints people confuse — plus what to do when a phone is lost and recovery codes are not the answer.
For whoever runs IT9 min readUpdatedTroubleshooting
Nothing arrived after "Forgot password?"
The reset link is a real, one-hour, single-use token sent by email — but the screen looks identical whether it sent or not. What decides delivery, and what to check first.
For whoever runs IT6 min readUpdatedTroubleshooting
OIDC sign-in fails
redirect_uri mismatch, invalid_client, state, nonce and PKCE — in both directions, with the verbatim OAuth error codes for each.
For whoever runs IT11 min readUpdatedTroubleshooting
Passkey registration fails
Origin and RP-ID pinning, the allowed-origin list, counter regression and cross-origin refusals — every passkey ceremony error verbatim, with what each one means.
For whoever runs IT10 min readUpdatedTroubleshooting
Reactivating a suspended user
A Reactivate button now sits on any inactive user's row. What pressing it restores, what it cannot bring back, and who is allowed to press it.
For whoever runs IT6 min readUpdatedTroubleshooting
SAML sign-in fails
Every rejection the SAML verifier produces, verbatim, matched to what is misconfigured at your identity provider and how to fix it.
For whoever runs IT11 min readUpdatedTroubleshooting
Signed out unexpectedly
Session lifetime, the idle timeout, what invalidates a session, the home-region refusal, and the multi-organisation limitation behind a 403.
For whoever runs IT10 min readUpdatedTroubleshooting
The sensor will not enrol
Every reason an endpoint sensor is refused at enrolment, the exact message for each, the installer exit codes, and the two errors that do not exist.
For whoever runs IT9 min readUpdatedTroubleshooting
This is not in your plan
Why a stale link or a direct API call can still land on a payment-required refusal even though the navigation no longer shows modules you have not bought, what the refusal actually says, and how to read the cheaper add-on option inside it.
For the business owner8 min readUpdatedTroubleshooting
When something goes wrong in the console
The error screens Qorionix shows you, the reference code to quote to support, what a missing page or a dropped connection means, and what to try first.
For the business owner7 min readUpdated