--- title: "Access and permission issues" slug: "access-and-permission-issues-in-tenant-manager" updated: 2026-11-02T06:53:54Z published: 2026-11-02T06:53:54Z canonical: "docs.turbo360.com/access-and-permission-issues-in-tenant-manager" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.turbo360.com/llms.txt > Use this file to discover all available pages before exploring further. # Access and permission issues ## Overview This article collects the problems people meet when a page, button, or whole module is not available to them in Tenant Manager, and how to fix them. Each item names the message or behavior you see, the cause, and the fix. ### Business value Most access problems have a short fix in a role setting or in the module being switched on. Finding the symptom here saves a support request and tells you exactly what to ask your administrator for. ## How it works Tenant Manager is switched on per account, and each role grants **Read** or **Manage** on its pages, either for the whole module, for a tenant group with everything beneath it, or for a single tenant. When a control is disabled, a missing permission is the usual reason. For the full list of permissions, see [Roles and permissions in Tenant Manager](https://docs.turbo360.com/docs/tenant-manager-roles-and-permissions). ## Troubleshooting ### Access and permissions These problems come from role settings and from Tenant Manager not being switched on. For the full list of permissions, see [Roles and permissions in Tenant Manager](https://docs.turbo360.com/docs/tenant-manager-roles-and-permissions). 1. **A Tenant Manager page is not available.** Cause: Tenant Manager is not enabled for your account yet, so a link opens the unauthorized page. Or your role does not include **Read** on that page, so the page shows "You do not have access to this page". Fix: If the unauthorized page opens, select **Request access** on the Tenant Manager card on the Home page, or wait for the Turbo360 team to switch the module on if you already sent a request. If the page says you do not have access, ask an administrator who can manage Tenant Manager access, such as a module owner, to add **Read** for the page. 2. **A button, switch, or menu entry is disabled or not shown.** Cause: Your role does not have the permission for that area. The tooltip reads "You are not authorized to perform this operation". Some controls are hidden instead of disabled. Fix: Ask an administrator who can manage Tenant Manager access, such as a module owner, to add the permission that matches the control: - Add to tasks, Ignore, and the Actions menu in Optimization: **Manage** on Optimization. - Request actions and Exclude from removals in Explore: **Manage** on Explore. - The pencil and reset icons for renaming a license (hidden when missing): **Manage tenants** for the tenant. - The automation switch and Configure automation: **Approve license tasks**. **View run history** stays available. If the tooltip says the option is unavailable because the app registration cannot remove licenses, see [Optimization and automation issues](https://docs.turbo360.com/docs/optimization-and-automation-issues-in-tenant-manager). - The alert or report switch, Configure, and Generate now: **Manage** on Alerts or Reports. **Alert history** and **Generation history** stay open to read. - The Sync button, tenant group or tenant menu entries, and Add tenant on an empty tenant group: **Manage tenants** or **Manage groups** for that tenant group or tenant. Someone whose role can manage tenants can also add the tenant for you. - The **Tenants** entry in the settings menu: **Manage tenants**. Entries your role can't use are disabled. - The **Escalation policies** entry in the settings menu: **Manage escalation policies**. - **Add user** and **Edit permission** in **User management**: **Manage users**. Without it, Owner and Contributor see **User management** as view-only. Other roles see the entry disabled. 3. **Approve and Decline are disabled.** Cause: Hover over the icon to see the reason. Your role may not have the **Approve license tasks** permission, or the task may already be closed. For **Approve** only, the tenant may be connected read-only, or the task may be a purchase change. Fix: Ask an administrator who can manage Tenant Manager access, such as a module owner, to turn on **Approve license tasks** for the role. A closed task has nothing left to decide. For a read-only tenant or a purchase change, use **Trigger notification** and then **Mark as done**. For a read-only tenant, you can also grant the missing permission to the app registration in Microsoft Entra ID. Turbo360 notices a granted or removed permission within about 5 minutes, so **Approve** can stay disabled for a short time after you grant the missing permission, and can stay enabled for a short time after a permission is removed. Syncing the tenant does not speed this up. 4. **A tenant group is grayed out in the tree view, or a message says a tenant group or tenant is outside your access.** Cause: A role can apply to the whole module, to a tenant group with everything beneath it, or to a single tenant. Find your case below. - A tenant group is grayed out when it is shown only because you have access to something inside it. Fix: No action is needed. - "This group is outside your Tenant Manager access." or "This tenant is outside your Tenant Manager access." The tenant group or tenant is outside the access you were given. Fix: Ask an administrator who can manage Tenant Manager access, such as a module owner, to assign a role that covers it. - "Adding a tenant at the root needs access to the whole module." or "Creating a top-level group needs access to the whole module." Your role applies only to some tenant groups or tenants. Fix: Ask for a role that applies to the whole module, or add the tenant or tenant group inside one you can manage. 5. **The Explain button or the AI agents tab is not shown.** Cause: AI agents are switched off for the account, your role does not have the **Use AI agents** permission, or, on private hosting, no OpenAI connection is saved. The button and the tab are hidden, not disabled. Fix: Ask an administrator who can manage Tenant Manager access, such as a module owner, to turn on the **AI agents** toggle under **Settings** > **General settings** (SaaS) or **Settings** > **OpenAI connection** (private hosting). Ask an administrator to turn on **Use AI agents** for your Tenant Manager role. On private hosting, save the connection first. See [OpenAI setup in Turbo360](https://docs.turbo360.com/docs/openai-setup-in-turbo360). ## Related articles - [Roles and permissions in Tenant Manager](https://docs.turbo360.com/docs/tenant-manager-roles-and-permissions) - [Request access to Tenant Manager](https://docs.turbo360.com/docs/request-access-to-tenant-manager) - [License tasks](https://docs.turbo360.com/docs/license-tasks-in-tenant-manager) - [Managing tenant groups](https://docs.turbo360.com/docs/managing-groups-in-tenant-manager) - [Limits and defaults](https://docs.turbo360.com/docs/limits-and-defaults-in-tenant-manager) - [Optimization and automation issues](https://docs.turbo360.com/docs/optimization-and-automation-issues-in-tenant-manager) - [Access and permission strategy](https://docs.turbo360.com/docs/access-and-permission-strategy-in-tenant-manager) - [OpenAI setup in Turbo360](https://docs.turbo360.com/docs/openai-setup-in-turbo360)