Troubleshooting Entra ID
The reports that come in most often when an Entra ID connection is not behaving, what usually causes each one, and what to do about it.
Most reports fall into one of the rows below. The first two columns usually identify the problem before you need to change anything.
User signs in but gets no access
They are in no mapped group, and the connection is not set to admit everyone
Add them to a mapped group in Entra, or map the group they are already in. They must sign in again.
A mapping never matches anyone
The object ID belongs to a Microsoft 365 group or distribution list, not a security group
Use a security group. Check the group type on its Overview page.
A mapping never matches anyone, and it is a security group
The wrong ID was copied — something other than the group's Object ID
Recheck on the group Overview, as in Group Object ID.
Struct reports that the sign-in token carried no group claims
The groups are not being sent to the Struct PIM application in the token
Check that the groups are assigned to the Struct PIM application in Entra ID, as in Restricting who may sign in at all.
Changes in Entra have no effect
The user has not signed in again since the change
Have them sign out and back in.
Changes in Entra have no effect, and they have signed in again
The connection is paused
Check the connection card. A connection showing Paused changes nothing.
The Microsoft Entra ID page is missing in Struct
The subscription does not include it, or the user lacks the permission
Contact your account manager, and check the user's Struct role.
A user is refused by Entra before reaching Struct at all
Assignment required is set to Yes and they are not assigned to the application
Add them under Users and groups on the Struct PIM enterprise application. That gate sits in front of everything else here.
Nobody can sign in after turning on the membership policy
No connection admits them
Check the connection's access scope and its mappings.