Press CTRL+K to open search

Tenant connection issues

  • 6 minute(s) read
Prev Next

Overview

This article collects the problems people meet when they connect a Microsoft 365 tenant to Tenant Manager, edit a connection, or organize tenants in tenant groups, and how to fix them. Each item names the message or behavior you see, the cause, and the fix.

Business value

Most connection problems come down to an admin consent or a client secret in Microsoft Entra ID rather than a fault in Tenant Manager. A single place to look up the message saves a support request and gets your first sync running sooner.

How it works

Connecting a tenant needs an app registration in Microsoft Entra ID with the required Microsoft Graph application permissions and admin consent. Validate checks the client secret, the directory, and the permissions before you save. Many problems trace back to one of three things: consent that was not granted, a permission that is missing, or a role that applies only to part of the tree. For the full steps, see Connect a Microsoft 365 tenant. For default values and fixed rules, see Limits and defaults.

Troubleshooting

Connecting a tenant

These problems appear while you validate or save a connection. For the full steps, see Connect a Microsoft 365 tenant and Managing Microsoft 365 tenants.

  1. Validate shows a message instead of succeeding.
    Cause: Microsoft Entra ID or Microsoft Graph returned a problem. Find your message below.

    • "The client secret works, but it cannot see any directory. Check that admin consent was granted." Microsoft returned no directory for the app registration. Fix: In Microsoft Entra ID, select Grant admin consent for the app registration's API permissions, then validate again.
    • "Connected to {directory}, but {n} of the {m} required permissions is not granted", followed by the missing names. Fix: In the app registration, add each missing permission under API permissions as a Microsoft Graph Application permission, then select Grant admin consent.
    • "This directory is already connected through this same app registration." The directory and app registration are already connected as a tenant. Fix: Use the existing tenant. To connect the directory a second time, use a different app registration. Its seats would be counted twice in the totals.
    • "The client secret is wrong. The secret ID was probably copied instead of the secret value." Fix: In the app registration, copy the secret Value (not the secret ID) from Certificates & secrets, then select Validate again.
    • "The client secret has expired. Create a new one. An expired secret cannot be recovered." Fix: Create a new secret in Certificates & secrets, then select Validate again.
    • "The client id does not exist in that Microsoft Entra ID, or admin consent was never granted.", "The Microsoft Entra ID is wrong.", or "The app registration is disabled in that Microsoft Entra ID." Fix: Check that the Microsoft Entra ID and Client id belong to the same app registration, that it is enabled, and that admin consent is granted. Then select Validate again.
    • "Microsoft did not respond within 45 seconds, which usually means this app registration is being throttled." Fix: Wait a minute and select Validate again.

  2. Connect or Add tenant is blocked, or asks for more information.
    Cause: Tenant Manager shows one of the messages below.

    • "Enter the client secret's expiry date." appears when no expiry date was entered and Tenant Manager could not read it from the app registration because Application.Read.All is not granted. A variant says the secret could not be found on the app registration, which usually means the app is registered in another directory. Fix: Enter Client secret expiration by hand (Azure shows it under Certificates & secrets), or grant Application.Read.All and validate again. Without the date, the Client secret expiry alert can't warn you in time.
    • Connect shows that a tenant or a service principal with that name already exists, because tenant names must be unique across Tenant Manager and friendly names must be unique across the service principals saved in your account. Fix: Enter a different Tenant name, Name, or Friendly name.
    • Add tenant shows that a saved service principal already uses this Microsoft Entra ID and client ID, with the saved principal's friendly name. This happens when you selected Add new service principal for a pair that is already saved in your account. Fix: Clear Add new service principal and select the saved service principal, or enter a different app registration.
    • Adding a tenant or creating a top-level tenant group fails with a message about access to the whole module, because your role applies only to a tenant group or a tenant. Fix: Ask for a role at the module level, or add the tenant inside a tenant group you can manage.

  3. A tenant is connected but does not sync, or shows an Expired badge.
    Cause: The tenant is connected, but a sync can't run or can't finish. Find your case below.

    • A message says the tenant is connected but its first sync could not be queued, because Tenant Manager saved the tenant but could not queue the first sync. Fix: No action is needed. The tenant syncs at the next scheduled time. To get data sooner, select Sync on the tenant.
    • An Expired badge means the expiry date you entered has passed. Syncs don't check that date, so they keep running until Microsoft rejects the secret. The sync then stops working, and the icon next to Last synced shows Microsoft's error. Fix: Create a new secret in the app registration, then replace it in Edit and validate it.
    • On a private hosted instance behind a proxy or firewall, connecting or syncing fails when outbound HTTPS (443) from the instance to one of the hosts Tenant Manager uses is blocked. Fix: Allow outbound HTTPS (443) to login.microsoftonline.com, graph.microsoft.com, management.azure.com, download.microsoft.com, and reports.office.com. The usage-report downloads also need the redirect from graph.microsoft.com to reports.office.com, which a proxy that inspects traffic can block, so allow that redirect too. The download link carries its own short-lived authorization.

Tenant groups and tenants

These problems appear when you create, edit, move, or delete tenant groups and tenants. For more, see Managing tenant groups.

  1. Create, Edit, or Move shows an error about the name or the destination.
    Cause: Create or Edit shows "A group with that name already exists." when another tenant group in Tenant Manager already uses the name. Move shows that the tenant group can't be moved into itself or into a tenant group inside it, because the destination is the tenant group itself or one of its nested tenant groups, which would cut it off from the tree.
    Fix: Choose a different name. Tenant group names are unique across the whole module. For Move, choose a tenant group outside the one you are moving.

  2. Update stays disabled on Edit tenant, or Delete is disabled for a service principal in Settings.
    Cause: Each control is disabled for its own reason.

    • Update stays disabled when a typed client secret is not validated, the expiry date is missing, the name is already taken, or nothing has changed. Fix: Validate the secret, enter the expiry date, choose a unique name, or change a field.
    • Delete is disabled when a tenant in Tenant Manager still uses the service principal added there. Hovering over Delete shows "Used by Tenant Manager. Delete the tenants that use it in Tenant Manager first." Fix: Delete the tenants that use the service principal in Tenant Manager first. Delete is then enabled. To replace its client secret instead, select Edit on it in Settings, or edit the tenant in Tenant Manager.

Related articles