Troubleshooting

Three families of failure exist, and they are worth telling apart before you start debugging: the service principal cannot reach Azure, a person cannot sign in to the app, or both work and the data is wrong. They have no causes in common.

Azure access errors

These come back from Azure, either to the setup wizard or to your own az commands.

Code	Cause	Fix
AuthorizationFailed	The role is missing at the scope you called, or it was assigned in the last few minutes and Azure has not propagated it yet	Confirm the assignment, then wait up to ten minutes and retry. Propagation delay reads exactly like a missing role, and most first attempts are the delay
AADSTS53003, or another AADSTS code on the service principal	A workload-identity Conditional Access policy is blocking infralign-reader	Ask Infralign for the ingestion runtime’s egress IPs and scope the policy by named location. Excluding the identity outright also works and is the weaker answer: it drops your own control rather than narrowing it
HTTP 403 on generateCostDetailsReport	The subscription has Reader but not Cost Management Reader. The cost report is a POST action, and Reader does not cover actions	Assign Cost Management Reader at the same scope
AuthorizationPermissionMismatch on a storage command	The identity running the command holds a control-plane role only. Container and SAS operations need data-plane rights	Grant yourself Storage Blob Data Contributor, or use the account keys. See FOCUS exports
Microsoft.ResourceGraph/resources/read named in a failure	Reader is missing on that subscription	Assign Reader at management group or subscription scope

Both roles, their scopes, and a least-privilege alternative are in permissions. To reproduce any of these by hand and keep the output for a change record, use the az CLI validation runbook.

Sign-in errors

These come back to a person opening the app in a browser. Full procedure and screenshots: dashboard sign-in.

Code or screen	Cause	Fix
”This account is not linked to a customer”	The address signed in with is not the address on the account. A colleague’s own account on another tenant produces this too	Compare the two addresses first. If they match, email support with the address and your tenant’s directory ID
AADSTS65001 or AADSTS90094, admin approval needed	Your tenant blocks user consent and the Portal app has not been consented to	A Global Administrator opens the consent URL. Most tenants have admin notification switched off, so nobody is told the request exists
AADSTS700016, application not found	Admin consent was never granted, so the Portal app was never provisioned in your tenant	Grant admin consent
AADSTS65004, user declined	Someone selected Cancel on the consent screen	Re-open the consent URL and accept
AADSTS50011, redirect URI mismatch	The reply URL does not match what the app expects	This one is Infralign’s to fix. Email support
Signed in, then every page returns 403	The address is not on the account allowlist, or differs from what their Microsoft account asserts	An admin adds the exact address Microsoft returns, on the People page

The data looks wrong

Access is working here. Something upstream is missing or late.

Symptom	Cause	Fix
A subscription shows no billed total	Cost Management Reader is missing on it	Assign the role. The figure appears after the next nightly run, not immediately
Cost is there, inventory and CPU are empty	Reader is missing on that subscription	Assign Reader, then select Re-check the connection
A subscription you expected is on no dashboard	It was left out at the Scope step, created after setup, or has no Reader assignment	Tick it on the connection page and save. A subscription created after setup is never added on its own
Fewer subscriptions found than expected	Discovery cannot see a subscription the service principal cannot read	Assign Reader, then re-run discovery from the Scope step
A dashboard reads STALE	A source missed its expected landing window	Open the Data Ops dashboard. Its source-freshness table names the feed and how far behind it is
A chatbot answer disagrees with a dashboard tile	Usually a different date filter or cost basis, not a data fault	Check whether one is on billed and the other on effective cost. Cost terms has the distinction
A Monitor probe returns an empty timeseries	The VM is stopped or has no samples in the window	Valid output. Point the probe at a running VM
An Advisor query returns nothing, with HTTP 200	Advisor has generated no recommendations for that subscription yet	Valid output. The probe still proves read access

Cost data typically trails real time by a day, and FOCUS by up to a month. Both are by design. Reading the freshness banner gives the expected window per lane, which is what turns “late” into “stale”.

When none of these match

Support lists what to send, per kind of problem. The error code and the subscription ID save a round trip.