Troubleshooting

A scan that hangs at the same percentage for more than a couple of minutes is almost always a transient network or Microsoft Graph blip. Cindera gives you two ways out, depending on which state the scan is in.

1. Cancel appears next to the progress card once a scan has been running for more than 10 seconds. Click it to cancel cleanly. Cindera records the cancellation in the audit log and clears the in-flight state.
2. If the scan UI reports Scan failed, click Reset scan instead. This clears the failed state so you can start a new scan from the dashboard.
3. After cancelling or resetting, give it 10 seconds and click Run scan now again. If the second attempt also stalls, see the next section.

The Microsoft consent screen returns an error or simply refuses to complete. The usual causes are:

• Personal Microsoft account. The Cindera scanner app is a multi-tenant work/school app — it cannot be consented from an outlook.com /hotmail.com account. Sign in with the work account that owns your tenant.
• Not a Global Administrator. Admin consent for application-level Graph permissions is restricted to the Global Administrator or Privileged Role Administratorroles. Other admin roles can't complete the flow.
• Tenant restricts user consent in unusual ways. Some tenants disable admin consent through policy. Your Entra admin can re-enable it under Enterprise applications → Consent and permissions.
• You completed the flow in a different tenant than the one you signed into Cindera with. Cindera returns a tenant_mismatch error in this case. Sign out of Cindera, sign back in with the account that owns the tenant you want to connect, and try again.

A surprisingly clean scan is sometimes genuinely good news — but it can also mean Cindera didn't get back the data it needed. Check the following before celebrating:

• Permissions actually consented. Visit Connections and confirm the scanner is listed as Connected with all seven scopes. If any are missing, click Re-authorise to redo consent — common after Cindera adds a new rule that needs a permission.
• PIM-eligible roles. If your admins use PIM and have not activated their roles for a while, sign-in activity may look stale even on healthy accounts. Run a scan during business hours when PIM activations are most likely.
• Recently changed tenant.Microsoft Graph can take 24 to 48 hours to fully reflect new conditional access policies, new role assignments, or new app registrations. Re-scan after a day if you've just made structural changes.
• Graph propagation delays. A scan that runs within minutes of a configuration change occasionally sees a partial state. The next nightly scan will catch up.

1. Check spam / quarantine. Recurring reports are sent from reports@cinder.example via Resend. Add the domain to your safe-sender list once and the issue usually disappears.
2. Verify the recipient in Settings. Open Settings → Recurring reports, confirm the email address is correct, and re-save. A typo in a distribution alias is the most common cause.
3. Verify the sender domain at your end. Some tenants block external mail with attachments by default. Your mail admin should whitelist cinder.example and allow PDF attachments from it.
4. Confirm a scan ran. Recurring reports use the latest completed scan. If no scan completed during the cadence window, the schedule sends a brief note saying so rather than re-sending stale data.

Most fields on a finding come from Microsoft Graph, and Graph occasionally returns incomplete data for service principals, tenant-internal apps, or recently deleted users. When that happens, Cindera marks the field Unknown rather than show a stale value.

1. Run a new scan. A subsequent Graph call usually returns the full object. Most Unknown entries disappear after the next scheduled run.
2. Check the affected resource ID. The finding still includes the underlying ID — paste it into the Entra admin centre search to identify the resource by hand.
3. If it persists, the resource is genuinely orphaned. An ownerless service principal, an assignment to a deleted account, or a stale policy reference. The finding itself is the right starting point for cleanup.

Email support@cindera.eu. A human reads every message and replies within one business day. For incidents or security-sensitive questions, mark the subject line [security] so it gets prioritised.

When you write in about a scan or finding issue, including your tenant's sign-in domain (e.g. contoso.onmicrosoft.com) and the approximate time of the issue lets us pull the relevant logs immediately.