Skip to content

13. Troubleshooting

Cause. Directory sync only runs once the console is actually live. Granting admin consent turns the status green, but on some earlier versions the Self‑Hosted 1‑click consent did not switch the console to live on its own.

Fix / recovery.

  • Self‑Hosted: open Settings → Microsoft 365 → Manual → Test connection, or re‑run admin consent. A successful test switches the console to live.
  • SaaS: use Re‑check to reconcile consent.
  • Then run Sync now; users and groups populate.

The Connection Assistant status chips and the Cloud Sync card help confirm the live state at a glance.

Setup Wizard won’t advance past “Directory access”

This is by design — the Graph step is a hard gate. Continue stays disabled until Graph is connected (Self‑Hosted: the connection test succeeds; SaaS: admin consent is granted). Missing individual permissions are a warning only and do not block a working connection. Once connected, the wizard enables Continue and auto‑advances.

“Finish setup” says “only available in SaaS mode”

Fixed. The Setup Wizard now finishes cleanly in Self‑Hosted too, not just SaaS.

PowerShell bootstrap errors on New-MgApplication

The generated key credential no longer includes explicit start/end dates (the certificate’s own validity governs it), which previously conflicted and errored. Re‑generate the certificate and re‑copy/download the script. The script also sets $ErrorActionPreference = "Stop" and creates the Exchange Online service principal if it is missing.

Certificate expiry banner

Appears when the certificate is within 30 days of expiry. Use Regenerate. Fresh certificates are valid ≤ 729 days (~728 days remaining) and will not trigger the banner.

Low‑contrast text in dark mode

Resolved globally — light‑grey/indigo/rose/etc. utilities are remapped for dark mode. If you spot a remaining faint spot on a specific screen, report it with a screenshot.