Troubleshooting

Find your error code in the table for your failure type.

Three families exist, with no causes in common: the service principal cannot reach Azure, a person cannot sign in, or both work and the data is wrong.

The service principal that reads your estate is the Infralign enterprise application. On the legacy classic setup it is the infralign-reader application you registered yourself. The rows below say which where it matters.

Azure access errors

These come back from Azure, either to the setup wizard or to your own az commands.

Code	Cause	Fix
AuthorizationFailed	The role is missing at the scope you called, or it was assigned in the last few minutes and Azure has not propagated it yet	Confirm the assignment, then wait up to ten minutes and retry. Propagation delay reads exactly like a missing role, and most first attempts are the delay
AADSTS53003, or another AADSTS code on the service principal	A workload-identity Conditional Access policy is blocking the identity that reads your estate	Ask Infralign for the nightly run’s egress IPs and scope the policy by named location. Excluding the identity also works and is weaker
HTTP 403 on generateCostDetailsReport	The subscription has Reader but not Cost Management Reader. The cost report is a POST action, and Reader does not cover actions	Assign Cost Management Reader at the same scope
AuthorizationPermissionMismatch on a storage command	The identity running the command holds a control-plane role only. Container and SAS operations need data-plane rights	Grant yourself Storage Blob Data Contributor, or use the account keys. See FOCUS exports
Microsoft.ResourceGraph/resources/read named in a failure	Reader is missing on that subscription	Assign Reader at management group or subscription scope

Both roles and their scopes are in permissions. To reproduce any of these by hand and keep the output for a change record, use the az CLI validation runbook.

Sign-in errors

These come back to a person opening the app in a browser. Full procedure and screenshots: dashboard sign-in.

Code or screen	Cause	Fix
”This account is not linked to a customer”	The address signed in with is not the address on the account. A colleague’s own account on another tenant produces this too	Compare the two addresses first. If they match, email support with the address and your tenant’s directory ID
AADSTS65001 or AADSTS90094, admin approval needed	Your tenant blocks user consent and the Portal app has not been consented to	A Global Administrator opens the consent URL. Most tenants have admin notification switched off, so nobody is told the request exists
AADSTS700016, application not found	Admin consent was never granted, so the Portal app was never provisioned in your tenant	Grant admin consent
AADSTS65004, user declined	Someone selected Cancel on the consent screen	Re-open the consent URL and accept
AADSTS50011, redirect URI mismatch	The reply URL does not match what the app expects	This one is Infralign’s to fix. Email support
Signed in, then every page returns 403	The address is not on the account allowlist, or differs from what their Microsoft account asserts	An admin adds the exact address Microsoft returns, on the People page

The data looks wrong

Access is working here. Something upstream is missing or late.

Symptom	Cause	Fix
A subscription shows no billed total	Cost Management Reader is missing on it	Assign the role. The figure appears after the next nightly run, not immediately
Cost is there, inventory and CPU are empty	Reader is missing on that subscription	Assign Reader, then select Re-check the connection
A subscription you expected is on no dashboard	It was left out at the Scope step, created after setup, or has no Reader assignment	Tick it on the connection page and save. A subscription created after setup is never added on its own
Fewer subscriptions found than expected	Discovery cannot see a subscription the service principal cannot read	Assign Reader, then re-run discovery from the Scope step
A dashboard reads STALE	A source missed its expected landing window	Open the Data Ops dashboard. Its source-freshness table names the feed and how far behind it is
A chatbot answer disagrees with a dashboard tile	Usually a different date filter or cost basis, not a data fault	Check whether one is on billed and the other on effective cost. Cost terms has the distinction
A Monitor probe returns an empty timeseries	The VM is stopped or has no samples in the window	Valid output. Point the probe at a running VM
An Advisor query returns nothing, with HTTP 200	Advisor has generated no recommendations for that subscription yet	Valid output. The probe still proves read access

Reading the freshness banner gives the expected window per lane.

When none of these match

Support lists what to send, per kind of problem. The error code and the subscription ID save a round trip.