The purpose of this document is to document common integration errors that may be seen for Microsoft Integrations, and ways to handle these errors. These would be applicable for all the Microsoft integrations in FSM such as Office 365, Azure AD, Power BI, etc.
Each Microsoft integration may have a slightly different set of steps to setup the integration. If the integration immediately fails, and no tasks are run, then generally there is a permissions issue, or an issue with the values entered during authorization. Please verify that the correct steps have been followed, as detailed in the integration instructions and then reauthorize.
If the integration is successful, and the tasks initially run, but start failing at a later time, then there should be an error logged in the integration task log files. The integration task log files can be found under the integration tab for the application. There will be a Download link for each task that will allow you to download the log file for each task that failed. the following screen capture illustrates:
The log file will typically indicate why the task has failed. You will typically see the error at the bottom of the log file in the summary section. For example:
Summary:
failed to retrieve datasource data
Detail:
failed to sign request
GET https://graph.microsoft.com/beta/reports/getOffice365ActiveUserDetail%!d(MISSING)ate=2021-03-05%!?(MISSING)%!f(MISSING)ormat=application%!F(MISSING)json&%!t(MISSING)op=800
signing failed with "422 Unprocessable Entity"
Location:
datasource "ds_application_access"
script "js_get_users_activity_script"
argument "users_activity"
datasource "ds_get_users_activity"
In this case, the "signing failed with "422 Unprocessable Entity" message can be used to diagnose the problem. The following table shows the most commonly occurring errors for Microsoft integrations:
Errors
Commonly Occurred Scenarios
Resolution
401 UnAuthorized Error
Refresh Token is revoked/Expired
Authorization Failure while authorizing the Integration
In Case of Client Credentials, Entered invalid User Input Credentials
You will need to re-authorize with necessary Minimum Permissioned User
In the case of Client Credentials, You will have to re-enter the valid credentials
403 Forbidden Error "{\"error\":{\"code\":\"S2SUnauthorized\",\"message\":\"Invalid permission.\"}}
403 Forbidden Error {"code": "Authentication_RequestFromUnsupportedUserRole", "message": "User is not in the allowed roles"}
Only the Application Access task fails with 403 error and the application roster task continues to execute without any issues
In this case, after authorizing the integration, user role permission used for authorizing is revoked, so this user needs to be assigned Report Reader permission. After which task will continue to execute successfully from the next run
If all the integration task fails with 403 forbidden Error
In this case, the user used for authorizing the integration is Deleted from their account. You willl need to re-Authorize the integration to resolve this
In the case of Client Credentials usually, this error is caused either when you have not added the API permissions to the created app in the Azure portal, or if it is added then admin consent would be pending.
404 Not Found Error, The requested resource doesn’t exist.
NA
Contact Support Team for further debugging.
422 Unprocessable Entity
If the password of the user used for authorizing the integration is changed by the user or reset by the account admin.
This generally indicates that the refresh token in FSM is invalid. Internally, this generates a 400 bad requests error. But this error is handled by the Flexera CQE engine, and you see 422 error in the execution log. This can be resolved by re-authorizing the integration by a user with the necessary permissions.
As can be seen, reauthorizing will typically resolve most issues, after confirming the correct values and permissions for the integration.
... View more
