Press CTRL+K to open search

Optimization and automation issues

  • 7 minute(s) read
Prev Next

Overview

This article collects the problems people meet when they raise, approve, or review license tasks, work with swap recommendations, or run license removal automation, and how to fix them. Each item names the message or behavior you see, the cause, and the fix.

Business value

Tasks and automations change licenses in Microsoft 365, so a blocked or failed change needs a quick, correct fix. Finding the cause here helps you get the change through, or confirm it was right to stop.

How it works

Tasks and automations read the data from the last sync and ask Microsoft for permission to change licenses. Many problems trace back to a missing Microsoft permission, a role that lacks Manage on Optimization, or data that is out of date. A task must be approved before anything changes, while an automation runs on its own once it is on. For default values and fixed rules, see Limits and defaults.

Troubleshooting

Recommendations and tasks

These problems appear when you raise, approve, or review tasks. For more, see License tasks and Swap license recommendations.

  1. Add to tasks, a request, or Ignore is refused.
    Cause: Five different things can refuse the action. Find your case below.

    • Add to tasks is disabled with "Already requested" because an open task already covers the change. Fix: Open the Tasks tab and approve or decline the existing task, and then raise the request again.
    • A removal request is blocked and says that a user is excluded, because the user is excluded from removals in Tenant Manager. Fix: Include the user in removals in Explore first, if the removal is intended.
    • A task for a person who was excluded after the task was raised removes nothing, shows Failed, and says that the person is excluded in Tenant Manager. Fix: Clear the exclusion in Explore and raise the request again.
    • "This user has a pending license swap for this license. Approve or decline it in Tasks first." The user has an open swap request for this license. Fix: Open the Tasks tab, approve or decline the swap, and then raise the request again.
    • Ignoring or restoring fails with "That recommendation is already ignored" or "That recommendation was not ignored", because someone else ignored or restored the recommendation after you loaded the page. Fix: Reload the page. The row then appears under the right filter.

  2. Approve is disabled, or a task shows Failed.
    Cause: Either a permission or a task state blocks Approve, or the change could not be made in Microsoft 365. Find your case below.

    • Approve is always disabled for a purchase change and for a task that is already closed. Fix: A closed task has nothing left to decide. For a purchase change, use Trigger notification to send the task to your IT team, or Generate PowerShell script to run the change yourself, and then mark the task as done.
    • Approve is disabled because the tenant's app registration lacks a permission the change needs. For a license removal from a person, any one of User.ReadWrite.All, LicenseAssignment.ReadWrite.All, or Directory.ReadWrite.All is enough. For a license change on a group, any one of LicenseAssignment.ReadWrite.All, Group.ReadWrite.All, or Directory.ReadWrite.All. Fix: Ask your Microsoft Entra administrator to grant one of the permissions with admin consent, and then try again. Turbo360 notices a granted or removed permission within about 5 minutes, so Approve can stay disabled for a short time after the permission is granted, and enabled for a short time after it is removed. Syncing the tenant does not speed this up.
    • Approve is disabled because of your role. Fix: See Access and permission issues.
    • A task shows Failed when the change could not be made in Microsoft 365: Microsoft refused it, the tenant's client secret is no longer valid, or the person was excluded from removals after the task was raised. Open the task and read Why it failed and Status details. Fix: Fix the cause, and then raise the request again, or make the change yourself and select Mark as done. A Failed task cannot be approved again.
    • A message that Microsoft Graph returned 403 means a permission is listed for the tenant's app registration but admin consent was never given, or the permission is missing. Consent can also have been removed after the task was approved. Fix: Ask your Microsoft Entra administrator to grant admin consent.
    • A message such as "The client secret has expired" or "The client secret is wrong" means Turbo360 could not sign in to the tenant, because the secret expired or the secret ID was copied instead of the secret value. Fix: Update the tenant's client secret in Tenant Manager, and then raise the change again.

  3. Recommendations are missing, an explanation stops, or a notification could not be sent.
    Cause: These are four separate problems. Find your case below.

    • There are few or no swap recommendations when some access is missing or the usage reports hide user names. Some recommendations are missing, and a banner says that permissions are missing, when Turbo360 does not have a Microsoft permission that the recommendation needs. Fix: Select Permissions, or the information icon next to the Optimization page title, read which permissions are Not granted, ask your Microsoft Entra administrator to grant them with admin consent, and sync the tenant. If Real names in usage reports is missing, your Microsoft 365 administrator needs to clear Display concealed user, group, and site names in all reports under Settings > Org settings > Reports in the Microsoft 365 admin center. Then sync the tenant again.
    • "The explanation took longer than five minutes and was stopped." Explain on a recommendation took longer than five minutes, so Tenant Manager stopped it. Nothing changes in Microsoft 365, because an explanation only describes the recommendation. Fix: Try again later. If Explain is not shown at all, see Access and permission issues.
    • A failed Trigger notification means every delivery failed, for example because outbound email is not configured for your Turbo360 deployment or a channel was removed. Fix: Choose a working channel under Settings > Notification channels, or ask your administrator to configure outbound email. Nothing changes in Microsoft 365.
    • A note that the tenant does not have Microsoft Entra ID P1 means Microsoft provides no sign-in data, so Never signed in and Inactive list nobody on the Users tab, and usage reports do not stand in. Idle Copilot and swap recommendations still use usage reports. Fix: No action is needed unless you expect those two lists. They need sign-in data, which Microsoft provides with Microsoft Entra ID P1.

Automation

These problems appear on the Automation tab or in a run's history. For more, see License removal automation.

  1. Automation cannot remove licenses, or its switch and Configure automation are disabled.
    Cause: Three different things can cause this. Find your case below.

    • A banner says that automation cannot remove licenses in this tenant, because Turbo360 does not have permission to remove licenses there. Fix: Ask your Microsoft Entra administrator to grant one of User.ReadWrite.All, LicenseAssignment.ReadWrite.All, or Directory.ReadWrite.All as an application permission with admin consent. The banner can take up to about 5 minutes to clear after consent is granted, and a removed permission also takes up to about 5 minutes to show. Syncing the tenant does not speed this up. When the cause is the tenant's permission, you can still switch an automation off.
    • The switch and Configure automation are disabled because your role does not have the Approve license tasks permission, or Turbo360 is not allowed to remove licenses in the tenant. Fix: Ask an administrator to turn on Approve license tasks for your role. View run history stays available.
    • Saving fails with "Somebody set this automation up a moment ago. Reload the page to see their settings." because another user set up the same automation for this tenant at the same moment. Fix: Reload the page, check their settings, and apply your changes again.

  2. A run is Skipped or Stopped, a person keeps their license, or no summary email arrived.
    Cause: Five different outcomes. Find your case below.

    • A run shows Skipped for out-of-date data when the last good sync is older than 24 hours, or the sync is failing. Fix: Fix the sync. The next daily run after a good sync acts.
    • A run shows Skipped because no client secret is stored or the tenant's permissions could not be checked, when the tenant has no stored client secret, or Microsoft did not answer the permission check. Fix: For a missing client secret, edit the tenant and store a valid client secret. If Microsoft did not answer, no action is needed, because the next daily run checks again.
    • A run shows Stopped when it would have changed more accounts than the limit. Fix: Download the records, check the accounts, and raise Most accounts one run may act on if they are expected.
    • A person appears under Left alone and keeps their license when the person is excluded, their licenses come through a Microsoft Entra ID group, or their license includes a mailbox. Fix: No action is needed. Remove them from the group, or clear the mailbox option, if you want the license removed.
    • No summary email arrives when the run removed nothing, failed nothing, and was not blocked, or no recipient or channel is set. Fix: Check Notification settings in Configure automation. A run that sends no summary still appears in the run history.

Related articles