Troubleshooting
Sign-in succeeds but I see no tenants
Your sign-in account is not mapped to a Policytab workspace. Contact your workspace owner with the exact email address you used to sign in. The owner can invite that address from Settings → Members. Sign out and use the invitation link before trying again.
Tenant stuck in pending
Connect was not completed. From Customers, click Continue setup (or open Settings → Open connect) and save Graph app credentials.
Tenant stuck in consented (Import didn't fire)
Click Import now on the tenant onboarding page. If it errors with graph_credentials_unavailable, finish the Connect page first - each customer needs their own Graph app credentials in Vault.
"Requires Entra ID P2" on the Risk page
The customer doesn't have P2. Either upgrade their license or skip the Risk feature for this tenant. License detection refreshes on every Resync - if you know the SKU was added recently, click Resync first.
Drift report says "Baseline unavailable"
The tenant does not yet have a usable comparison reference. Run Resync first, then open the tenant's customer settings and select either the imported snapshot or an available workspace baseline. If neither option appears after a successful resync, contact your Policytab operator.
Apply fails with graph_patch_failed
The Graph PATCH returned a 4xx. Common causes:
- Permission missing - the app reg consent didn't include
Policy.ReadWrite.ConditionalAccess - Customer admin revoked app access or the secret expired - flip to
disconnectedand reconnect on the Connect page - Microsoft service degradation - check the Microsoft 365 status page and retry
The change_request row keeps the error message in error_message. After fixing root cause, re-run dry-run from the change detail page (status returns to draft after a failed apply; you can re-dry-run and re-apply).
"Sync N expired to Entra" never goes to zero
The sync-expired-exclusions worker normally removes expired memberships automatically. A nonzero count means removal is pending or failed. Open Time-bound access, review the entries, and click Sync N expired to Entra to retry. Membership is retained while another unexpired exclusion owns the same group/user pair, and destructive removal fails closed when ownership cannot be verified. If the count remains, verify the tenant's Graph connection and permissions.
Notification channel says "sent" but I didn't receive anything
- Slack: check the channel's webhook in Slack's app config. Webhooks expire if the workspace deleted the integration.
- Teams: same - the connector URL becomes invalid when the channel is deleted.
- Email: check the provider's bounce/complaint logs (Resend, SendGrid).
- Webhook: check your receiver logs. We sent a 200 from our side; the receiver may be silently dropping.
Use the channel's Test action after correcting its configuration. Policytab shows the latest delivery result without exposing the channel secret.