Back to App
Documentation/Troubleshoot/Remediation Issues

Remediation Issues

Diagnose and resolve common problems when remediating controls or rolling back drift events.

Write Permission Denied

Problem

Remediation fails with: "Authorization_RequestDenied" or "Insufficient privileges to complete the operation"

Cause

TrueConfig's default read-only permissions do not allow write operations. Auto-remediation requires additional Graph API permissions to be granted.

Resolution

  1. Navigate to Settings → Tenants → [Tenant Name]
  2. Click "Enable Write Permissions"
  3. A Microsoft consent dialog will appear requesting additional permissions
  4. Sign in with a Global Administrator account
  5. Grant the requested write permissions
  6. Retry the remediation action
Which Permissions Are Needed?
Write permissions are control-specific. For example, removing a Global Administrator requires RoleManagement.ReadWrite.Directory, while updating a Conditional Access policy requires Policy.ReadWrite.ConditionalAccess. TrueConfig only requests the minimum permissions needed for the specific remediation.

Conditional Access Policy Conflicts

Problem

Remediation fails with: "Policy conflict detected" or changes don't take effect as expected.

Cause

Multiple Conditional Access policies may have conflicting settings. When TrueConfig attempts to modify one policy, another policy may override or conflict with the change.

Resolution

Step 1: Identify Conflicting Policies

In Microsoft Entra admin center, navigate to Protection → Conditional Access → Policies. Look for policies that target the same users/groups and have overlapping conditions.

Step 2: Review Policy Precedence

Conditional Access policies are applied in order of strictness. A more restrictive policy will override a less restrictive one. Use the "What If" tool to simulate policy effects.

Step 3: Consolidate or Exclude

Either consolidate conflicting policies into a single policy, or add appropriate exclusions to prevent overlap. Then retry the remediation.

Test Before Applying
Always use Microsoft's "What If" tool in Entra admin center to test policy changes before applying them in production. This prevents accidental lockouts or access issues.

Rollback Failures

Problem

Attempting to rollback a drift event fails with an error, or the rollback completes but the configuration doesn't match the expected state.

Common Causes

Referenced Object Deleted

The user, group, or policy referenced in the rollback no longer exists in Microsoft Entra ID.

State Already Changed

Another administrator already fixed the issue manually, so the rollback target state no longer applies.

Dependency Missing

The rollback requires a dependent resource (like a named location or authentication context) that no longer exists.

API Rate Limiting

Microsoft Graph API throttled the request. Wait a few minutes and retry the rollback.

Resolution

  1. Check the drift event details to understand the original state
  2. Verify the referenced objects still exist in Microsoft Entra ID
  3. If objects were deleted, recreate them before attempting rollback
  4. Run a new scan to refresh TrueConfig's state snapshot
  5. If the issue was already fixed, dismiss the drift event

Safety Gate Blocks

Problem

Auto-remediation is blocked with a message like: "Safety gate prevented remediation" or "Action requires manual approval"

What Are Safety Gates?

Safety gates are protective checks that prevent potentially dangerous auto-remediation actions. They ensure high-impact changes require human review before execution.

Common Safety Gates

Break-Glass Account Protection

Prevents removal of the last Global Administrator to avoid lockout scenarios.

Policy Deletion Prevention

Blocks automatic deletion of Conditional Access policies; only modification is allowed.

Bulk Change Threshold

Requires approval when a single remediation affects more than 5 users or groups.

Critical Control Override

Critical controls (PA-01 through PA-03) always require manual approval before remediation.

Resolution

  1. Review the safety gate reason in the remediation details
  2. Navigate to Remediation → Pending Approvals
  3. Review the proposed change and affected resources
  4. Click "Approve" to proceed or "Reject" to cancel
  5. Optionally, add a justification note for audit purposes
Why This Matters
Safety gates exist to prevent accidental lockouts and ensure compliance. While they may seem like obstacles, they protect your organization from potentially catastrophic misconfigurations that could block all administrator access.

Justification Requirement Errors

Problem

Remediation fails with: "Justification required" or "Please provide a reason for this action"

Cause

Your organization has configured TrueConfig to require written justification for certain remediation actions. This is typically enabled for audit and compliance purposes.

Resolution

  1. Click on the remediation action you want to perform
  2. In the confirmation dialog, locate the "Justification" field
  3. Enter a clear, descriptive reason for the change (minimum 10 characters)
  4. Click "Submit" to proceed with the remediation

Good Justification Examples

  • "Removing temporary admin access granted for migration project (PROJ-1234)"
  • "Enforcing MFA per security policy update approved by CISO on 2024-01-15"
  • "Rolling back accidental change made during maintenance window"
  • "Compliance remediation per audit finding #42"
Justification Audit Trail
All justifications are permanently logged in TrueConfig's audit trail and may be included in compliance reports. Write justifications as if they will be reviewed by auditors.

General Troubleshooting Tips

Check Audit Logs

Navigate to Activity → Audit Log to see detailed error messages and stack traces for failed remediation attempts.

Run a Fresh Scan

Trigger a manual scan to ensure TrueConfig has the latest state. Stale data can cause remediation mismatches.

Verify Service Health

Check Microsoft Service Health for any ongoing Azure AD/Entra outages affecting Graph API.

Contact Support

If issues persist, contact TrueConfig support with the error details and tenant ID for investigation.

Related Resources

Auto-Remediation Guide Scale

Learn how to configure and use auto-remediation effectively.

Read the guide

Connection Issues

Troubleshoot tenant connection and permission problems.

View connection troubleshooting