--- title: "Optimization and automation issues" slug: "optimization-and-automation-issues-in-tenant-manager" updated: 2026-11-02T06:53:54Z published: 2026-11-02T06:53:54Z canonical: "docs.turbo360.com/optimization-and-automation-issues-in-tenant-manager" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.turbo360.com/llms.txt > Use this file to discover all available pages before exploring further. # Optimization and automation issues ## Overview This article collects the problems people meet when they raise, approve, or review license tasks, work with swap recommendations, or run license removal automation, and how to fix them. Each item names the message or behavior you see, the cause, and the fix. ### Business value Tasks and automations change licenses in Microsoft 365, so a blocked or failed change needs a quick, correct fix. Finding the cause here helps you get the change through, or confirm it was right to stop. ## How it works Tasks and automations read the data from the last sync and ask Microsoft for permission to change licenses. Many problems trace back to a missing Microsoft permission, a role that lacks **Manage** on Optimization, or data that is out of date. A task must be approved before anything changes, while an automation runs on its own once it is on. For default values and fixed rules, see [Limits and defaults](https://docs.turbo360.com/docs/limits-and-defaults-in-tenant-manager). ## Troubleshooting ### Recommendations and tasks These problems appear when you raise, approve, or review tasks. For more, see [License tasks](https://docs.turbo360.com/docs/license-tasks-in-tenant-manager) and [Swap license recommendations](https://docs.turbo360.com/docs/swap-license-recommendations-in-tenant-manager). 1. **Add to tasks, a request, or Ignore is refused.** Cause: Five different things can refuse the action. Find your case below. - Add to tasks is disabled with "Already requested" because an open task already covers the change. Fix: Open the **Tasks** tab and approve or decline the existing task, and then raise the request again. - A removal request is blocked and says that a user is excluded, because the user is excluded from removals in Tenant Manager. Fix: Include the user in removals in Explore first, if the removal is intended. - A task for a person who was excluded after the task was raised removes nothing, shows **Failed**, and says that the person is excluded in Tenant Manager. Fix: Clear the exclusion in Explore and raise the request again. - "This user has a pending license swap for this license. Approve or decline it in Tasks first." The user has an open swap request for this license. Fix: Open the **Tasks** tab, approve or decline the swap, and then raise the request again. - Ignoring or restoring fails with "That recommendation is already ignored" or "That recommendation was not ignored", because someone else ignored or restored the recommendation after you loaded the page. Fix: Reload the page. The row then appears under the right filter. 2. **Approve is disabled, or a task shows Failed.** Cause: Either a permission or a task state blocks **Approve**, or the change could not be made in Microsoft 365. Find your case below. - **Approve** is always disabled for a purchase change and for a task that is already closed. Fix: A closed task has nothing left to decide. For a purchase change, use **Trigger notification** to send the task to your IT team, or **Generate PowerShell script** to run the change yourself, and then mark the task as done. - **Approve** is disabled because the tenant's app registration lacks a permission the change needs. For a license removal from a person, any one of User.ReadWrite.All, LicenseAssignment.ReadWrite.All, or Directory.ReadWrite.All is enough. For a license change on a group, any one of LicenseAssignment.ReadWrite.All, Group.ReadWrite.All, or Directory.ReadWrite.All. Fix: Ask your Microsoft Entra administrator to grant one of the permissions with admin consent, and then try again. Turbo360 notices a granted or removed permission within about 5 minutes, so **Approve** can stay disabled for a short time after the permission is granted, and enabled for a short time after it is removed. Syncing the tenant does not speed this up. - **Approve** is disabled because of your role. Fix: See [Access and permission issues](https://docs.turbo360.com/docs/access-and-permission-issues-in-tenant-manager). - A task shows **Failed** when the change could not be made in Microsoft 365: Microsoft refused it, the tenant's client secret is no longer valid, or the person was excluded from removals after the task was raised. Open the task and read **Why it failed** and **Status details**. Fix: Fix the cause, and then raise the request again, or make the change yourself and select **Mark as done**. A **Failed** task cannot be approved again. - A message that Microsoft Graph returned 403 means a permission is listed for the tenant's app registration but admin consent was never given, or the permission is missing. Consent can also have been removed after the task was approved. Fix: Ask your Microsoft Entra administrator to grant admin consent. - A message such as "The client secret has expired" or "The client secret is wrong" means Turbo360 could not sign in to the tenant, because the secret expired or the secret ID was copied instead of the secret value. Fix: Update the tenant's client secret in Tenant Manager, and then raise the change again. 3. **Recommendations are missing, an explanation stops, or a notification could not be sent.** Cause: These are four separate problems. Find your case below. - There are few or no swap recommendations when some access is missing or the usage reports hide user names. Some recommendations are missing, and a banner says that permissions are missing, when Turbo360 does not have a Microsoft permission that the recommendation needs. Fix: Select **Permissions**, or the information icon next to the **Optimization** page title, read which permissions are **Not granted**, ask your Microsoft Entra administrator to grant them with admin consent, and sync the tenant. If **Real names in usage reports** is missing, your Microsoft 365 administrator needs to clear **Display concealed user, group, and site names in all reports** under Settings > Org settings > Reports in the Microsoft 365 admin center. Then sync the tenant again. - "The explanation took longer than five minutes and was stopped." **Explain** on a recommendation took longer than five minutes, so Tenant Manager stopped it. Nothing changes in Microsoft 365, because an explanation only describes the recommendation. Fix: Try again later. If **Explain** is not shown at all, see [Access and permission issues](https://docs.turbo360.com/docs/access-and-permission-issues-in-tenant-manager). - A failed **Trigger notification** means every delivery failed, for example because outbound email is not configured for your Turbo360 deployment or a channel was removed. Fix: Choose a working channel under Settings > Notification channels, or ask your administrator to configure outbound email. Nothing changes in Microsoft 365. - A note that the tenant does not have Microsoft Entra ID P1 means Microsoft provides no sign-in data, so **Never signed in** and **Inactive** list nobody on the Users tab, and usage reports do not stand in. Idle Copilot and swap recommendations still use usage reports. Fix: No action is needed unless you expect those two lists. They need sign-in data, which Microsoft provides with Microsoft Entra ID P1. ### Automation These problems appear on the Automation tab or in a run's history. For more, see [License removal automation](https://docs.turbo360.com/docs/license-removal-automation-in-tenant-manager). 1. **Automation cannot remove licenses, or its switch and Configure automation are disabled.** Cause: Three different things can cause this. Find your case below. - A banner says that automation cannot remove licenses in this tenant, because Turbo360 does not have permission to remove licenses there. Fix: Ask your Microsoft Entra administrator to grant one of User.ReadWrite.All, LicenseAssignment.ReadWrite.All, or Directory.ReadWrite.All as an application permission with admin consent. The banner can take up to about 5 minutes to clear after consent is granted, and a removed permission also takes up to about 5 minutes to show. Syncing the tenant does not speed this up. When the cause is the tenant's permission, you can still switch an automation off. - The switch and **Configure automation** are disabled because your role does not have the **Approve license tasks** permission, or Turbo360 is not allowed to remove licenses in the tenant. Fix: Ask an administrator to turn on **Approve license tasks** for your role. **View run history** stays available. - Saving fails with "Somebody set this automation up a moment ago. Reload the page to see their settings." because another user set up the same automation for this tenant at the same moment. Fix: Reload the page, check their settings, and apply your changes again. 2. **A run is Skipped or Stopped, a person keeps their license, or no summary email arrived.** Cause: Five different outcomes. Find your case below. - A run shows Skipped for out-of-date data when the last good sync is older than 24 hours, or the sync is failing. Fix: Fix the sync. The next daily run after a good sync acts. - A run shows Skipped because no client secret is stored or the tenant's permissions could not be checked, when the tenant has no stored client secret, or Microsoft did not answer the permission check. Fix: For a missing client secret, edit the tenant and store a valid client secret. If Microsoft did not answer, no action is needed, because the next daily run checks again. - A run shows Stopped when it would have changed more accounts than the limit. Fix: Download the records, check the accounts, and raise **Most accounts one run may act on** if they are expected. - A person appears under **Left alone** and keeps their license when the person is excluded, their licenses come through a Microsoft Entra ID group, or their license includes a mailbox. Fix: No action is needed. Remove them from the group, or clear the mailbox option, if you want the license removed. - No summary email arrives when the run removed nothing, failed nothing, and was not blocked, or no recipient or channel is set. Fix: Check **Notification settings** in **Configure automation**. A run that sends no summary still appears in the run history. ## Related articles - [Optimization overview](https://docs.turbo360.com/docs/optimization-overview-in-tenant-manager) - [License tasks](https://docs.turbo360.com/docs/license-tasks-in-tenant-manager) - [Swap license recommendations](https://docs.turbo360.com/docs/swap-license-recommendations-in-tenant-manager) - [License removal automation](https://docs.turbo360.com/docs/license-removal-automation-in-tenant-manager) - [Optimization and automation FAQs](https://docs.turbo360.com/docs/optimization-and-automation-faqs-in-tenant-manager) - [Access and permission issues](https://docs.turbo360.com/docs/access-and-permission-issues-in-tenant-manager) - [License optimization](https://docs.turbo360.com/docs/license-optimization-in-tenant-manager)