58 articles
Troubleshooting
Error messages, their cause and fix, and when to escalate.
Start here
- ErrorsError code indexThis index links each API error code and each service SQLSTATE to the article that explains its cause and fix.
- PhoneRequests do not reach my phone (notifications)You ask for an approval in the browser, but the phone shows no notification.
- PhoneI cannot link my phone (linking errors)The app shows «This phone could not be linked.» followed by a reason: Reason shown · Cause · What to do «The link request expired.
- Signing inMy passkey does not appear or does not work- The system offers no passkey when you choose «Sign in with a passkey (this device)».
- VPN and Wi-Fi (RADIUS)The VPN or Wi-Fi refuses sign-in (RADIUS Access-Reject or no answer)The VPN client or the Wi-Fi connection says the credentials are wrong, or waits until it gives up.
First steps1 article
Access policies1 article
Access recovery1 article
Domains1 article
Edge appliance2 articles
- Edge appliance warnings and errors (modules, audit, configuration)Warning or error · Cause · What to do «No heartbeat» · The appliance is not reporting · Check that the service is running and outbound port 443…
- The Edge appliance has a stale or stuck enrolmentUnder «Operate» › «Edge appliances», the appliance is stuck in a state that does not move on, or the appliance shows connection errors after it used…
Email1 article
Licences2 articles
- Limit reached (entitlement_exceeded, entitlement_required, plan_not_allowed)A creation is refused with «The limit is reached: no more organizations, seats or validity are available for this.
- Organization read-only or without an active licence (license_read_only, license_inactive)- Administrative changes are refused with «The organization's licence has expired: it is read-only until the licence is renewed.
Linux sign-in1 article
Microsoft 3651 article
OpenID Connect1 article
Organization4 articles
- «Activation is not finished.» (realm_activation_pending)The sign-in page shows «Activation is not finished.» with the detail «The activation code was already used, but the first administrator has not…
- «This organization awaits activation.» (realm_provisioning)The sign-in page shows «This organization awaits activation.» with the detail «Its first administrator activates it with the one-time code sent by…
- «This organization is scheduled for deletion.» (realm_pending_deletion)The sign-in page shows «This organization is scheduled for deletion.» with «Sign-in is closed.
- «This organization is suspended.» (realm_suspended)The sign-in page shows «This organization is suspended.» with «Sign-in is closed while the organization is suspended.
Passkeys1 article
People and groups1 article
Phone12 articles
- Requests do not reach my phone (notifications)You ask for an approval in the browser, but the phone shows no notification.
- I cannot link my phone (linking errors)The app shows «This phone could not be linked.» followed by a reason: Reason shown · Cause · What to do «The link request expired.
- «Phone approvals are paused for this account…» (device_approvals_suspended)Sign-in or approval shows «Phone approvals are paused for this account for a few minutes after repeated refusals.
- «Phone approvals are turned off for your organization.» (device_approvals_disabled)One of these messages: - «Phone approvals are turned off for your organization.» (API 403 device_approvals_disabled); on the phone, «Phone approvals…
- «The approval key is no longer valid.» (phone)When approving, the phone shows «The approval key is no longer valid.
- «There are already requests waiting for this account.» (device_sign_in_pending_limit)When choosing to sign in with the phone alone, the page shows «There are already requests waiting for this account.
- «This account already has the maximum of three phones.» (device_limit)When linking a new phone, the console shows «This account already has the maximum of three phones.
- «This account has no phone that can approve.» (no_device)When asking for a phone approval, the console shows «This account has no phone that can approve.» (API 409 no_device).
- «This application requires a passkey sign-in.» (phone approval not accepted)When signing in to an application, phone approval is not offered or is refused, with one of these messages: - In the browser: «This application…
- «This phone is no longer linked to this account.» (device_revoked)When opening a request, the phone shows «This phone is no longer linked to this account.» The API answers 403 device_revoked.
- «This phone is not supported.» (Android 14 and hardware keys)When opening the approver app, you see «This phone is not supported.
- «This request could not be verified.» and other request warnings on the phoneMessage on the phone · Cause · What to do «This request could not be verified.
Platform6 articles
- «Not found» (not_found, 404)«Not found, or outside your scope.», «Not found in your organization.» or «That organization or licence is not within your reach.» appears.
- «The operation was not allowed by the active policy or by your permissions.» (forbidden)An action is refused with «The operation was not allowed by the active policy or by your permissions.», «This area requires an active administrator…
- «This record already exists.» or «Someone else changed…» (conflict, 409)When saving, «This record already exists.», «Someone else changed these settings.
- «Too many attempts.» and error 429 (rate_limited)The page shows «Too many attempts. Wait a moment and try again.», or an integration receives 429 rate_limited with a Retry-After header.
- Invalid request (validation_error, invalid_request, invalid_cursor)The console shows that a field is not valid (usually next to the field), or «The requested page is no longer valid.
- Service unavailable, not responding or slow (503)The page shows one of these messages, or the API answers 503: - «Could not reach AuthGuard.
Privileged access (PAM)1 article
SAML1 article
SCIM and directory1 article
Security settings3 articles
- «Another administrator must approve this change.» (second_administrator_required)A change waits or is refused with «Another administrator must approve this change.», or, in privileged access, a message that it was sent for…
- The console asks you to confirm your identity again (recent confirmation expired)When saving a change (creating people, changing a setting, removing a phone, issuing a token), one of these appears: - «Confirm your authenticator…
- Your organization requires phone approval for administrative changesAn administrative change is refused with «This organization requires Presence approval for administrative changes.
Sessions1 article
Signing in6 articles
- My passkey does not appear or does not work- The system offers no passkey when you choose «Sign in with a passkey (this device)».
- «Could not verify the identity.» (invalid_credentials)The sign-in page shows «Could not verify the identity.» after you type the password, use the passkey or enter an activation or recovery code.
- «This operation requires a passkey with local verification.» (strong_authentication_required)When you try to administer or sign in to an application, «This operation requires a passkey with local verification.
- «This sign-in step was already used.» (continuation_consumed)In the second sign-in step (one-time code or second factor), «This sign-in step was already used.
- A second factor is asked for after the password (second_factor_required)After the right password, the page shows «Confirm it is you» instead of opening the console.
- Clock out of sync (device_clock_skew, one-time codes refused)- The phone or the browser shows «This device's clock differs from the server time.» (API 401 device_clock_skew).
VPN and Wi-Fi (RADIUS)2 articles
- The VPN or Wi-Fi refuses sign-in (RADIUS Access-Reject or no answer)The VPN client or the Wi-Fi connection says the credentials are wrong, or waits until it gives up.
- RadSec certificate problems (TLS)A device set up with «RadSec (TLS)» cannot authenticate: the TLS connection to port 2083 is refused or closes at once, or requests get no answer.
Windows6 articles
- The Windows agent update failed or is pausedUnder «Manage» › «Computers» › «Agent updates» you see «The rollout of 1.4.2 paused itself: a computer could not install it.
- The Windows computer does not enrol (AGW01, AGW02, AGW04, AGW05)After installing the MSI, the computer does not appear under «Manage» › «Computers», stays «Waiting for approval», or the agent's log shows one of…
- Windows: «Sign-in is not allowed right now. Contact IT support.»After the password, Windows shows «Sign-in is not allowed right now.
- Windows: «Sign-in was not approved»The Windows sign-in screen shows «Sign-in was not approved» with «The request was declined on the phone or it expired.
- Windows: «The code is not correct. Try again.» and pending requests (AGW06, AGW08)- «The code is not correct. Try again.» after typing the app code or the offline code.
- Windows: the service on this computer is not respondingThe Windows sign-in screen shows one of these messages: - that the authentication service on this computer is not responding; - that the service is…