Troubleshooting
A cross-product view of Microsoft Entra changes related to Troubleshooting.
Latest Troubleshooting changes
Enable and support passkeys in Authenticator for Microsoft Entra ID
Learn about Authenticator-specific requirements, configuration, and troubleshooting for passkeys in Microsoft Authenticator for Microsoft Entra ID.
Troubleshoot
Organizations that are deploying passkeys and have Conditional Access policies that require phishing-resistant authentication when accessing **All resources (formerly 'All cloud apps')** can run into a looping issue when users attempt to add a passkey to Microsoft Authenticator. For more information and possible workarounds, see [Workarounds for an authentication strength Conditional Access policy loop](~/identity/authentication/how-to-enable-authenticator-passkey.md#workarounds-for-an-authentication-strength-conditional-access-policy-loop).
Troubleshooting
- The object or property isn't supported for preview in the current release.
Configure MX3 Diagnostics Connector for automatic user provisioning with Microsoft Entra ID
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to MX3 Diagnostics Connector.
Howto Analyze Activity Logs With Microsoft Graph
> Error code 1002013 indicates an expected (and successful) interrupt of the sign-up flow. [Learn more](howto-troubleshoot-sign-up-errors.md#sign-up-error-codes)
Microsoft Authenticator app: Upcoming changes to jailbreak and root detection
Starting February 2026, Microsoft Authenticator will block Entra credentials on jailbroken/rooted iOS and Android devices to enhance security. The rollout includes a warning phase followed by blocking. This feature is automatic, affects all users on such devices, and requires no admin action. Notify users and update documentation accordingly.
Add SMS one-time passcode MFA to an iOS and macOS app using native authentication
Learn how to add multifactor authentication (MFA) with SMS one-time passcode (OTP) to an iOS or macOS app using native authentication, including enforcing MFA with authentication context and handling MFA errors.
An app page shows an error message after the user signs in
How to resolve issues with Microsoft Entra sign-in when the app returns an error message.
Customer intent: As an authentication administrator, I want to troubleshoot voice call and SMS problems with multifactor authentication (MFA) for Mic…
A Microsoft Entra documentation page was updated: Customer intent: As an authentication administrator, I want to troubleshoot voice call and SMS problems with multifactor authentication (MFA) for Microsoft Entra ID..
Customer intent: As an IT administrator, I want to learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to MX3…
A Microsoft Entra documentation page was updated: Customer intent: As an IT administrator, I want to learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to MX3 Diagnostics so that I can streamline the user management process and ensure that users have the appropriate access to MX3 Diagnostics..
Customer intent: I want to troubleshoot the Global Secure Access client using the Advanced diagnostics utility.
Troubleshoot the Global Secure Access client using the health check tab in the advanced diagnostics utility.
Customer intent: I want to troubleshoot the Global Secure Access client using the Health check tab in the Advanced diagnostics utility.
Troubleshoot the Global Secure Access client using the Health check tab in the Advanced diagnostics utility.
Fix mismatched directory errors in Microsoft Entra Domain Services | Microsoft Docs
Learn what a mismatched directory error means and how to resolve it in Microsoft Entra Domain Services
How to investigate private application access requiring Microsoft Entra Private Access connector
Learn how to monitor and troubleshoot private application access scenarios that require the Microsoft Entra Private Access connector, using Microsoft Entra Health monitoring tools.
How to investigate the Global Secure Access remote network connectivity
Learn how to monitor and troubleshoot remote network connectivity using Microsoft Entra Health monitoring.
IP addresses advertised over BGP by remote network connectivity
Understand critical IP address ranges to consider when configuring and troubleshooting internet over remote network connectivity.
Microsoft Entra authentication & authorization error codes
Learn about the AADSTS error codes that are returned from the Microsoft Entra security token service (STS).
Problems signing in to a Microsoft application
Troubleshoot common problems faced when signing in to first-party Microsoft Applications using Microsoft Entra ID (like Microsoft 365).
Resolve network security group alerts in Microsoft Entra Domain Services | Microsoft Docs
Learn how to troubleshoot and resolve network security group configuration alerts for Microsoft Entra Domain Services
Resolve secure LDAP alerts in Microsoft Entra Domain Services | Microsoft Docs
Learn how to troubleshoot and resolve common alerts with secure LDAP for Microsoft Entra Domain Services.
Resolve service principal alerts in Microsoft Entra Domain Services | Microsoft Docs
Learn how to troubleshoot service principal configuration alerts for Microsoft Entra Domain Services
Troubleshoot a custom authentication extension
Troubleshoot and monitor your custom claims provider API. Learn how to use logging and Microsoft Entra sign-in logs to find errors and issues in your custom claims provider API.
Troubleshoot application access
Learn how to troubleshoot application access problems with the Global Secure Access Windows client.
Troubleshoot Authentication Strengths
Learn how to resolve errors when you're using Microsoft Entra Conditional Access authentication strengths.
Troubleshoot Device Registration Command Tool on Linux
This article covers how to use the output from the Device Registration command tool on Linux to understand the state of devices in Microsoft Entra ID.
Troubleshoot devices by using the dsregcmd command
A Microsoft Entra documentation page was updated: Troubleshoot devices by using the dsregcmd command.
Troubleshoot Global Secure Access Client Disabled
This document provides troubleshooting guidance for the Global Secure Access client when it shows the "disabled by your organization" error message.
Troubleshoot Global Secure Access Client Macos Health Check
Troubleshoot the macOS Global Secure Access client using the Health check tab in the Advanced diagnostics utility.
Troubleshoot Global Secure Access Mobile Client Advanced Diagnostics
ai-usage: ai-assisted
Troubleshoot High Scale Compatibility (HSC) mode
Diagnose and resolve common errors when using the High Scale Compatibility (HSC) API for migrating from Azure AD B2C to Microsoft Entra External ID.
Troubleshoot Hybrid Join Windows Legacy
A Microsoft Entra documentation page was updated: Troubleshoot Hybrid Join Windows Legacy.
Troubleshoot Mac Sso Extension Plugin
This article helps to troubleshoot deploying the Microsoft Enterprise SSO plug-in on Apple devices
Troubleshoot password-based single sign-on
Troubleshoot issues with a Microsoft Entra app configured for password-based single sign-on.
Troubleshoot problems signing in to an application from My Apps portal
Troubleshoot problems signing in to an application from Microsoft Entra My Apps
Troubleshoot prompt injection protection
Reduce risk from malicious or manipulated prompts sent to generative AI sites and apps with prompt injection protection policies in Global Secure Access.
Troubleshoot the Global Secure Access mobile client with Health check utility
Learn if a device can communicate with the Global Secure Access service and tunnel traffic, by using the health check utility.
Troubleshoot Transport Layer Security inspection errors
Learn how to troubleshoot and resolve Transport Layer Security (TLS) inspection errors in Global Secure Access.
Troubleshooting Enterprise State Roaming settings in Microsoft Entra ID
A Microsoft Entra documentation page was updated: Troubleshooting Enterprise State Roaming settings in Microsoft Entra ID.
Troubleshooting the configured permissions limits
Learn why some apps may exceed the limits on configured permissions and how to address this issue.
Unexpected consent prompt when signing in to an application
How to troubleshoot when a user sees a consent prompt for an application you've integrated with Microsoft Entra ID that you didn't expect
Unexpected Error When Performing Consent to an Application
This article discusses errors that can occur during the process of consenting to an application and what you can do about them.
Your sign-in was blocked
Troubleshoot a blocked sign-in to the Microsoft Application Network portal.
Troubleshoot Combined Registration
Troubleshoot Microsoft Entra multifactor authentication and self-service password reset combined registration.
Configure MX3 Diagnostics Connector for automatic user provisioning with Microsoft Entra ID
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to MX3 Diagnostics Connector.
Hr User Update Issues
Learn how to troubleshoot user update issues with HR provisioning
Register Didwebsite
The portal verifies that `did.json` is reachable and correct when you select **Refresh registration status**. You should also consider verifying that you can request that URL in a browser to avoid errors like not using HTTPS, a bad TLS/SSL certificate, or the URL not being public. If the `did.json` file can't be requested anonymously in a browser or via tools such as `curl`, without warnings or errors, the portal won't be able to complete the **Refresh registration status** step.
Servicenow Provisioning Tutorial
If you still can't resolve your problem, contact ServiceNow support, and ask them to turn on SOAP debugging to help troubleshoot.
Troubleshoot access to Azure resources denied in Privileged Identity Management
If you're experiencing issues with Privileged Identity Management (PIM) in Microsoft Entra ID, the information included in this article can help you resolve these issues.
Remediate risks and unblock users
Learn how to configure user self-remediation and manually remediate risky users in Microsoft Entra ID Protection.
Troubleshoot Security Copilot Policies
1. Browse to **Entra ID** > **Conditional Access**.
How to use enriched Microsoft 365 logs
View performance, experience, and availability insights for Microsoft 365 apps routed through Microsoft Entra Internet Access. Integrate enriched log data with Log Analytics or Microsoft Sentinel for network diagnostics and security analysis.
View Deployment Logs
Monitor and troubleshoot configuration changes in Global Secure Access using deployment logs. Learn how to view logs, configure settings, and analyze fields.
Troubleshoot Connectors
Troubleshoot Distributed File System
The proposed workaround for the above-mentioned scenario is as follows.
Troubleshoot Conditional Access
To get detailed information about the sign-in interruption, review the Microsoft Entra sign-in events to see which Conditional Access policy or policies applied and why.
Zscaler Coexistence
1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. Select the **Traffic** tab and select **Start collecting**.
Troubleshoot Global Secure Access Client Ios Health Check Utility
A Microsoft Entra documentation page was updated: Troubleshoot Global Secure Access Client Ios Health Check Utility.
Troubleshoot the Global Secure Access mobile client with Health check utility
Learn if a device can communicate with the Global Secure Access service and tunnel traffic, by using the health check utility.
How to use enriched Microsoft 365 logs
View performance, experience, and availability insights for Microsoft 365 apps routed through Microsoft Entra Internet Access. Integrate enriched log data with Log Analytics or Microsoft Sentinel for network diagnostics and security analysis.
Troubleshoot Global Secure Access Client Ios Health Check Utility
In the [Microsoft Intune admin center](https://intune.microsoft.com/), confirm the following criteria:
Troubleshoot Alerts
Upon successful onboarding, Domain Services back fills synchronized users and groups with the onboarded custom attribute values. The custom attribute values appear gradually, depending on the size of the tenant. To check the backfill status, go to [Domain Services Health](check-health.md) and verify the **Synchronization with Microsoft Entra ID** monitor timestamp has updated within the last hour.
Learn how to solve an issue where Global Secure Access fails with a Distributed File System
A troubleshooting article that includes a workaround for a case where a Distributed File System (DFS) doesn't operate correctly with Global Secure Access.
Troubleshoot problems installing the Microsoft Entra private network connector
Troubleshoot problems installing the Microsoft Entra private network connector.
Troubleshoot Application Proxy
Learn how to troubleshoot common errors and configuration problems with Microsoft Entra application proxy.
Add SMS one-time passcode MFA to an iOS and macOS app using native authentication
Learn how to add multi-factor authentication (MFA) with SMS one-time passcode (OTP) to an iOS or macOS app using native authentication, including enforcing MFA with authentication context and handling MFA errors.
Troubleshoot problems installing the Microsoft Entra private network connector
Troubleshoot problems installing the Microsoft Entra private network connector.
Troubleshoot the Windows Global Secure Access client: Health check
Troubleshoot the Global Secure Access client using the Health check tab in the Advanced diagnostics utility.
Remediate risks and unblock users
Learn how to configure user self-remediation and manually remediate risky users in Microsoft Entra ID Protection.
Learn how to solve an issue where Global Secure Access fails with a Distributed File System
A troubleshooting article that includes a workaround for a case where a Distributed File System (DFS) doesn't operate correctly with Global Secure Access.
Troubleshoot App Access
Learn how to troubleshoot application access problems with the Global Secure Access Windows client.
Troubleshoot the Global Secure Access Client for Windows: Advanced Diagnostics
Troubleshoot the Global Secure Access client using the health check tab in the advanced diagnostics utility.
Troubleshoot the Global Secure Access Client: Disabled by Your Organization
This document provides troubleshooting guidance for the Global Secure Access client when it shows the "disabled by your organization" error message.
Troubleshoot the Global Secure Access Mobile Client: Advanced Diagnostics
Discover how to use advanced diagnostics to resolve issues with the Global Secure Access mobile client for Android and iOS.
Troubleshoot the macOS Global Secure Access client: Health check
Troubleshoot the macOS Global Secure Access client using the Health check tab in the Advanced diagnostics utility.
Troubleshoot the Windows Global Secure Access client: Health check
Troubleshoot the Global Secure Access client using the Health check tab in the Advanced diagnostics utility.
Troubleshoot Transport Layer Security
Learn how to troubleshoot and resolve Transport Layer Security (TLS) inspection errors in Global Secure Access.
View and Analyze Deployment Logs in Global Secure Access
Monitor and troubleshoot configuration changes in Global Secure Access using deployment logs. Learn how to view logs, configure settings, and analyze fields.
Troubleshoot B2B issues
Learn how to troubleshoot common issues with Microsoft Entra B2B collaboration. Resolve guest sign-in errors, direct connect access problems, policy update failures, and encrypted email access issues.
Broken Links in an Application
Troubleshoot problems with broken links in application proxy apps that are integrated with Microsoft Entra ID.
On Premises Ecma Troubleshoot
Describes how to troubleshoot various issues you might encounter when you install and use the ECMA Connector Host.
Report automatic user account provisioning from Microsoft Entra ID to Software as a Service (SaaS) applications
Learn how to check the status of automatic user account provisioning jobs, and how to troubleshoot the provisioning of individual users.
Resolve a 'Corporate app can't be accessed' error
Learn how to resolve common access issues with Microsoft Entra application proxy applications.
Troubleshoot Application Proxy
Learn how to troubleshoot errors in Microsoft Entra application proxy.
Troubleshoot attribute retrieval issues with HR provisioning
Learn how to troubleshoot attribute retrieval issues with HR provisioning
Troubleshoot insufficient access rights error
Learn how to troubleshoot InsufficientAccessRights error when provisioning to on-premises Active Directory.
Troubleshoot issues with inbound provisioning API
This article provides potential issues and resolutions that guide you in how to troubleshoot issues with the inbound provisioning API.
Troubleshoot Kerberos Constrained Delegation
Learn how to troubleshoot a Kerberos constrained delegation (KCD) configuration in Microsoft Entra application proxy.
Troubleshoot manager update issues with HR provisioning
This article provides potential issues and resolutions that show you how to troubleshoot manager update issues with HR provisioning
Troubleshoot provisioning to a Microsoft Entra gallery app.
How to troubleshoot common issues faced when configuring user provisioning to an application already listed in the Microsoft Entra application gallery.
Troubleshoot user creation issues with HR provisioning
Learn how to troubleshoot user creation issues with HR provisioning
Troubleshoot user update issues with HR provisioning
Learn how to troubleshoot user update issues with HR provisioning
Troubleshoot writeback issues with HR provisioning
This article provides potential issues and resolutions so you can troubleshoot writeback issues with HR provisioning.
Users aren't being provisioned in my application
Troubleshoot common issues faced when a user isn't appearing in a Microsoft Entra Gallery Application configured for user provisioning with Microsoft Entra ID.
Broken Links in an Application
Troubleshoot problems with broken links in application proxy apps that are integrated with Microsoft Entra ID.
Customer intent: As an IT admin, I want to learn how to remediate risks and unblock users in Microsoft Entra ID Protection.
author: shlipsey3
Customer intent: I want to troubleshoot the Global Secure Access client using the Advanced diagnostics utility.
author: HULKsmashGithub