> For the complete documentation index, see [llms.txt](https://docs.struct.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.struct.com/tutorials/guides/how-to-use-microsoft-entra-id/troubleshooting-entra-id.md). # Troubleshooting Entra ID The reports that come in most often when an Entra ID connection is not behaving, what usually causes each one, and what to do about it. Most reports fall into one of the rows below. The first two columns usually identify the problem before you need to change anything. | Symptom | Likely cause | What to do | | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | User signs in but gets no access | They are in no mapped group, and the connection is not set to admit everyone | Add them to a mapped group in Entra, or map the group they are already in. They must sign in again. | | A mapping never matches anyone | The object ID belongs to a Microsoft 365 group or distribution list, not a security group | Use a security group. Check the group type on its Overview page. | | A mapping never matches anyone, and it is a security group | The wrong ID was copied — something other than the group's Object ID | Recheck on the group Overview, as in [Group Object ID](/tutorials/guides/how-to-use-microsoft-entra-id/how-to-find-the-ids-in-entra-id.md#group-object-id). | | Struct reports that the sign-in token carried no group claims | The groups are not being sent to the Struct PIM application in the token | Check that the groups are assigned to the Struct PIM application in Entra ID, as in [Restricting who may sign in at all](/tutorials/guides/how-to-use-microsoft-entra-id/how-to-find-the-ids-in-entra-id.md#restricting-who-may-sign-in-at-all-optional). | | Changes in Entra have no effect | The user has not signed in again since the change | Have them sign out and back in. | | Changes in Entra have no effect, and they have signed in again | The connection is paused | Check the connection card. A connection showing **Paused** changes nothing. | | The Microsoft Entra ID page is missing in Struct | The subscription does not include it, or the user lacks the permission | Contact your account manager, and check the user's Struct role. | | A user is refused by Entra before reaching Struct at all | **Assignment required** is set to **Yes** and they are not assigned to the application | Add them under **Users and groups** on the Struct PIM enterprise application. That gate sits in front of everything else here. | | Nobody can sign in after turning on the membership policy | No connection admits them | Check the connection's access scope and its mappings. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.struct.com/tutorials/guides/how-to-use-microsoft-entra-id/troubleshooting-entra-id.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.