Troubleshooting

Microsoft Entra Cloud Sync error codes and descriptions

The AzureActiveDirectoryInvalidCredential and AzureActiveDirectoryExpiredCredentials entries no longer reference the cloud service-account repair cmdlet.

Microsoft Entra Cloud Sync troubleshooting

The troubleshooting article no longer documents the Repair-AADCloudSyncToolsAccount cmdlet or its usage steps.

Troubleshoot Device Registration Tool Linux

The Linux device registration troubleshooting documentation now shows a different tenant ID in its example output.

Troubleshoot Device Registration Tool Linux

The example Tenant ID was changed from 12345678-90ab-cdef-1234-567890abcdef to aaaabbbb-0000-cccc-1111-dddd2222eeee.

Manage Device Identities

The documentation now states that the “Users may join devices to Microsoft Entra ID” setting applies to Windows 10 or newer, macOS, and Linux. It also adds troubleshooting guidance to verify registration or join settings when users encounter errors.

Tshoot Connect Sync Errors

The troubleshooting documentation now directs administrators to the Hard match scenarios and recovery paths when DataValidationFailed occurs during a hard match operation, while retaining guidance to validate userPrincipalName characters and format.

Tshoot Connect Sync Errors

The troubleshooting guide now covers DataValidationFailed alongside IdentityDataValidationFailed, including cases where onPremisesObjectIdentifier changes during hard match operations. It also adds guidance for checking userPrincipalName formatting and using the documented hard match recovery paths.

Connect to Microsoft Graph.

The documentation now uses clearer commands to enable and verify `AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled`, and explicitly shows how to set it back to `$false` after remediation to re-enable hard match protection.

Troubleshoot Device Registration Tool Linux

> [!NOTE]

Understanding errors during Microsoft Entra synchronization

ai-usage: ai-assisted

Troubleshooting

- The object or property isn't supported for preview in the current release.

Configure MX3 Diagnostics Connector for automatic user provisioning with Microsoft Entra ID

Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to MX3 Diagnostics Connector.

Howto Analyze Activity Logs With Microsoft Graph

> Error code 1002013 indicates an expected (and successful) interrupt of the sign-up flow. [Learn more](howto-troubleshoot-sign-up-errors.md#sign-up-error-codes)

Customer intent: As an IT administrator, I want to learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to MX3…

A Microsoft Entra documentation page was updated: Customer intent: As an IT administrator, I want to learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to MX3 Diagnostics so that I can streamline the user management process and ensure that users have the appropriate access to MX3 Diagnostics..

Customer intent: I want to troubleshoot the Global Secure Access client using the Advanced diagnostics utility.

Troubleshoot the Global Secure Access client using the health check tab in the advanced diagnostics utility.

Customer intent: I want to troubleshoot the Global Secure Access client using the Health check tab in the Advanced diagnostics utility.

Troubleshoot the Global Secure Access client using the Health check tab in the Advanced diagnostics utility.

Error Handling Claims Challenges

manager: pmwongera

Error Handling Introduction

manager: pmwongera

Error Handling Retries

manager: pmwongera

Error Logging Introduction

manager: pmwongera

Fix mismatched directory errors in Microsoft Entra Domain Services | Microsoft Docs

Learn what a mismatched directory error means and how to resolve it in Microsoft Entra Domain Services

How to investigate private application access requiring Microsoft Entra Private Access connector

Learn how to monitor and troubleshoot private application access scenarios that require the Microsoft Entra Private Access connector, using Microsoft Entra Health monitoring tools.

How to investigate the Global Secure Access remote network connectivity

Learn how to monitor and troubleshoot remote network connectivity using Microsoft Entra Health monitoring.

Howto Troubleshoot Upn Changes

manager: martinco

IP addresses advertised over BGP by remote network connectivity

Understand critical IP address ranges to consider when configuring and troubleshooting internet over remote network connectivity.

Path Length Tip

manager: pmwongera

Resolve network security group alerts in Microsoft Entra Domain Services | Microsoft Docs

Learn how to troubleshoot and resolve network security group configuration alerts for Microsoft Entra Domain Services

Resolve secure LDAP alerts in Microsoft Entra Domain Services | Microsoft Docs

Learn how to troubleshoot and resolve common alerts with secure LDAP for Microsoft Entra Domain Services.

Resolve service principal alerts in Microsoft Entra Domain Services | Microsoft Docs

Learn how to troubleshoot service principal configuration alerts for Microsoft Entra Domain Services

Troubleshoot application access

Learn how to troubleshoot application access problems with the Global Secure Access Windows client.

Troubleshoot Device Registration Command Tool on Linux

This article covers how to use the output from the Device Registration command tool on Linux to understand the state of devices in Microsoft Entra ID.

Troubleshoot devices by using the dsregcmd command

A Microsoft Entra documentation page was updated: Troubleshoot devices by using the dsregcmd command.

Troubleshoot Global Secure Access Client Disabled

This document provides troubleshooting guidance for the Global Secure Access client when it shows the "disabled by your organization" error message.

Troubleshoot Global Secure Access Client Macos Health Check

Troubleshoot the macOS Global Secure Access client using the Health check tab in the Advanced diagnostics utility.

Troubleshoot Global Secure Access Mobile Client Advanced Diagnostics

ai-usage: ai-assisted

Troubleshoot High Scale Compatibility (HSC) mode

Diagnose and resolve common errors when using the High Scale Compatibility (HSC) API for migrating from Azure AD B2C to Microsoft Entra External ID.

Troubleshoot Hybrid Join Windows Legacy

A Microsoft Entra documentation page was updated: Troubleshoot Hybrid Join Windows Legacy.

Troubleshoot Mac Sso Extension Plugin

This article helps to troubleshoot deploying the Microsoft Enterprise SSO plug-in on Apple devices

Troubleshoot Macos Platform Single Sign On Extension

manager: pmwongera

Troubleshoot Primary Refresh Token

editor: v-jsitser

Troubleshoot prompt injection protection

Reduce risk from malicious or manipulated prompts sent to generative AI sites and apps with prompt injection protection policies in Global Secure Access.

Troubleshoot the Global Secure Access mobile client with Health check utility

Learn if a device can communicate with the Global Secure Access service and tunnel traffic, by using the health check utility.

Troubleshoot Transport Layer Security inspection errors

Learn how to troubleshoot and resolve Transport Layer Security (TLS) inspection errors in Global Secure Access.

Troubleshooting Enterprise State Roaming settings in Microsoft Entra ID

A Microsoft Entra documentation page was updated: Troubleshooting Enterprise State Roaming settings in Microsoft Entra ID.

Troubleshooting the configured permissions limits

Learn why some apps may exceed the limits on configured permissions and how to address this issue.

61006

**Remediation action**

61008

**Remediation action**

61011

**Remediation action**

Configure MX3 Diagnostics Connector for automatic user provisioning with Microsoft Entra ID

Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to MX3 Diagnostics Connector.

Hr User Update Issues

Learn how to troubleshoot user update issues with HR provisioning

Error Codes

| Error | Description |

Diagnostic settings are configured for all Microsoft Entra logs

author: kenwith

Register Didwebsite

The portal verifies that `did.json` is reachable and correct when you select **Refresh registration status**. You should also consider verifying that you can request that URL in a browser to avoid errors like not using HTTPS, a bad TLS/SSL certificate, or the URL not being public. If the `did.json` file can't be requested anonymously in a browser or via tools such as `curl`, without warnings or errors, the portal won't be able to complete the **Refresh registration status** step.

Servicenow Provisioning Tutorial

If you still can't resolve your problem, contact ServiceNow support, and ask them to turn on SOAP debugging to help troubleshoot.

Troubleshoot access to Azure resources denied in Privileged Identity Management

If you're experiencing issues with Privileged Identity Management (PIM) in Microsoft Entra ID, the information included in this article can help you resolve these issues.

Remediate risks and unblock users

Learn how to configure user self-remediation and manually remediate risky users in Microsoft Entra ID Protection.

How to use enriched Microsoft 365 logs

View performance, experience, and availability insights for Microsoft 365 apps routed through Microsoft Entra Internet Access. Integrate enriched log data with Log Analytics or Microsoft Sentinel for network diagnostics and security analysis.

View Deployment Logs

Monitor and troubleshoot configuration changes in Global Secure Access using deployment logs. Learn how to view logs, configure settings, and analyze fields.

Troubleshoot Connectors


Troubleshoot Distributed File System

The proposed workaround for the above-mentioned scenario is as follows.

Zscaler Coexistence

1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. Select the **Traffic** tab and select **Start collecting**.

Troubleshoot the Global Secure Access mobile client with Health check utility

Troubleshooting

**If the difference report is running for a long time:**

Troubleshoot Global Secure Access Client Ios Health Check Utility

Troubleshoot Global Secure Access Client Ios Health Check Utility

A Microsoft Entra documentation page was updated: Troubleshoot Global Secure Access Client Ios Health Check Utility.

Troubleshoot the Global Secure Access mobile client with Health check utility

Learn if a device can communicate with the Global Secure Access service and tunnel traffic, by using the health check utility.

Troubleshoot the Global Secure Access mobile client with Health check utility

How to use enriched Microsoft 365 logs

View performance, experience, and availability insights for Microsoft 365 apps routed through Microsoft Entra Internet Access. Integrate enriched log data with Log Analytics or Microsoft Sentinel for network diagnostics and security analysis.

Troubleshoot Global Secure Access Client Ios Health Check Utility

In the [Microsoft Intune admin center](https://intune.microsoft.com/), confirm the following criteria:

Groups Troubleshooting

To disable group creation for nonadmin users in PowerShell:

Troubleshoot Alerts

Upon successful onboarding, Domain Services back fills synchronized users and groups with the onboarded custom attribute values. The custom attribute values appear gradually, depending on the size of the tenant. To check the backfill status, go to [Domain Services Health](check-health.md) and verify the **Synchronization with Microsoft Entra ID** monitor timestamp has updated within the last hour.

Learn how to solve an issue where Global Secure Access fails with a Distributed File System

A troubleshooting article that includes a workaround for a case where a Distributed File System (DFS) doesn't operate correctly with Global Secure Access.

Troubleshoot problems installing the Microsoft Entra private network connector

Troubleshoot problems installing the Microsoft Entra private network connector.

Troubleshoot Application Proxy

Learn how to troubleshoot common errors and configuration problems with Microsoft Entra application proxy.

Mx3 Diagnostics Connector Provisioning Tutorial

author: jeevansd

Troubleshoot problems installing the Microsoft Entra private network connector

Troubleshoot problems installing the Microsoft Entra private network connector.

Troubleshoot the Windows Global Secure Access client: Health check

Troubleshoot the Global Secure Access client using the Health check tab in the Advanced diagnostics utility.

Error Codes

Reference of error codes for Microsoft Entra Verified ID APIs

Remediate risks and unblock users

Learn how to configure user self-remediation and manually remediate risky users in Microsoft Entra ID Protection.

Customer Intent: As a Global Secure Access Administrator, I need to know critical IP address ranges to consider when configuring and troubleshooting…

ai-usage: ai-assisted

Learn how to solve an issue where Global Secure Access fails with a Distributed File System

A troubleshooting article that includes a workaround for a case where a Distributed File System (DFS) doesn't operate correctly with Global Secure Access.

Troubleshoot App Access

Learn how to troubleshoot application access problems with the Global Secure Access Windows client.

Troubleshoot the Global Secure Access Client for Windows: Advanced Diagnostics

Troubleshoot the Global Secure Access client using the health check tab in the advanced diagnostics utility.

Troubleshoot the Global Secure Access Client: Disabled by Your Organization

This document provides troubleshooting guidance for the Global Secure Access client when it shows the "disabled by your organization" error message.

Troubleshoot the Global Secure Access Mobile Client: Advanced Diagnostics

Discover how to use advanced diagnostics to resolve issues with the Global Secure Access mobile client for Android and iOS.

Troubleshoot the macOS Global Secure Access client: Health check

Troubleshoot the macOS Global Secure Access client using the Health check tab in the Advanced diagnostics utility.

Troubleshoot the Windows Global Secure Access client: Health check

Troubleshoot the Global Secure Access client using the Health check tab in the Advanced diagnostics utility.

Troubleshoot Transport Layer Security

Learn how to troubleshoot and resolve Transport Layer Security (TLS) inspection errors in Global Secure Access.

View and Analyze Deployment Logs in Global Secure Access

Monitor and troubleshoot configuration changes in Global Secure Access using deployment logs. Learn how to view logs, configure settings, and analyze fields.

Known issues in external tenants

Learn about known issues in external tenants.

Broken Links in an Application

Troubleshoot problems with broken links in application proxy apps that are integrated with Microsoft Entra ID.

On Premises Ecma Troubleshoot

Describes how to troubleshoot various issues you might encounter when you install and use the ECMA Connector Host.

Report automatic user account provisioning from Microsoft Entra ID to Software as a Service (SaaS) applications

Learn how to check the status of automatic user account provisioning jobs, and how to troubleshoot the provisioning of individual users.

Troubleshoot Application Proxy

Learn how to troubleshoot errors in Microsoft Entra application proxy.

Troubleshoot attribute retrieval issues with HR provisioning

Learn how to troubleshoot attribute retrieval issues with HR provisioning

Troubleshoot insufficient access rights error

Learn how to troubleshoot InsufficientAccessRights error when provisioning to on-premises Active Directory.

Troubleshoot issues with inbound provisioning API

This article provides potential issues and resolutions that guide you in how to troubleshoot issues with the inbound provisioning API.

Troubleshoot Kerberos Constrained Delegation

Learn how to troubleshoot a Kerberos constrained delegation (KCD) configuration in Microsoft Entra application proxy.

Troubleshoot manager update issues with HR provisioning

This article provides potential issues and resolutions that show you how to troubleshoot manager update issues with HR provisioning

Troubleshoot provisioning to a Microsoft Entra gallery app.

How to troubleshoot common issues faced when configuring user provisioning to an application already listed in the Microsoft Entra application gallery.

Troubleshoot user creation issues with HR provisioning

Learn how to troubleshoot user creation issues with HR provisioning

Troubleshoot user update issues with HR provisioning

Learn how to troubleshoot user update issues with HR provisioning

Troubleshoot writeback issues with HR provisioning

This article provides potential issues and resolutions so you can troubleshoot writeback issues with HR provisioning.

Users aren't being provisioned in my application

Troubleshoot common issues faced when a user isn't appearing in a Microsoft Entra Gallery Application configured for user provisioning with Microsoft Entra ID.

Broken Links in an Application

Troubleshoot problems with broken links in application proxy apps that are integrated with Microsoft Entra ID.

Customer intent: As an IT admin, I want to learn how to remediate risks and unblock users in Microsoft Entra ID Protection.

author: shlipsey3

Customer intent: I want to troubleshoot the Global Secure Access client using the Advanced diagnostics utility.

author: HULKsmashGithub

Customer intent: I want to troubleshoot the Global Secure Access client using the Health check tab in the Advanced diagnostics utility.

author: HULKsmashGithub

How to troubleshoot sign-up errors

Learn how to troubleshoot sign-up errors using Microsoft Entra reports in the Microsoft Entra admin center

Howto Continuous Access Evaluation Troubleshoot

author: shlipsey3

include file

include file

Ip Addresses Advertised By Remote Network Connectivity

Understand critical IP address ranges to consider when configuring and troubleshooting internet over remote network connectivity.

Preview Known Issues

Learn about currently known issues and errors encountered when using the Microsoft Entra Agent ID preview.

Troubleshoot application access

Learn how to troubleshoot application access problems with the Global Secure Access Windows client.

Troubleshoot Application Proxy

Learn how to troubleshoot errors in Microsoft Entra application proxy.

Troubleshoot Distributed File System

A troubleshooting article that includes a workaround for a case where a Distributed File System (DFS) doesn't operate correctly with Global Secure Access.

Troubleshoot entitlement management

Learn about some items you should check to help you troubleshoot Microsoft Entra entitlement management.

Troubleshoot Global Secure Access Client Disabled

author: HULKsmashGithub

Troubleshoot Global Secure Access Client Macos Health Check

author: HULKsmashGithub

Troubleshoot Global Secure Access Mobile Client Advanced Diagnostics

author: HULKsmashGithub