Troubleshoot onboarding
Use this page when Verify fails or data is missing after you follow the Onboarding guide. For Dynamics 365 symptoms, see Troubleshooting level 2 in the Dynamics 365 guide.
Verify and first sync
| Symptom | Likely cause | Fix |
|---|---|---|
Verify returns AADSTS70011 | Wrong tenant signed in to the Azure Portal | Sign in to the Portal with an account from your own tenant, then repeat the steps |
| Graph permissions stay Not granted | Admin consent step skipped | Open the App Registration, then API permissions → Grant admin consent for <Tenant> |
Insufficient privileges on the first Microsoft 365 sync | Graph permission missing or not consented | Re-check the table in Step 3 |
| Sync stays at 0% after 30 minutes | An Azure role is missing, or the assignment has not propagated | Run Verify. If it reports a missing role, check the assignments on Assign Azure RBAC roles |
| Microsoft 365 adoption shows zeros after the first sync | Microsoft conceals user names in its usage reports | See Show real names in Microsoft 365 usage reports |
| Authentication is refused | The client secret of your Zation Platform Connector App Registration has expired or been rotated | Renew the client secret |
Renew an expired client secret
You created the client secret in Step 2 of the Onboarding guide. It belongs to your Zation Platform Connector App Registration, so you renew it. Plan for a few minutes.
- In the Azure Portal, open Microsoft Entra ID → App registrations and select Zation Platform Connector.
- Open Certificates & secrets → + New client secret.
- Set Description to
Zation Platformand Expires to24 months, then select Add. - Copy the secret value right away. Microsoft shows it only once.
- In the Platform, open Settings → Tenants and replace the client secret of your tenant with the new value.
- Select Verify.
- After Verify succeeds, delete the old secret under Certificates & secrets in Microsoft Entra ID.
Add a calendar reminder before the new secret expires.
Azure RBAC
| Symptom | Likely cause | Fix |
|---|---|---|
| Role assignment fails at tenant scope (Reservations or Savings Plans) | The Access management for Azure resources toggle is off | Set the toggle to Yes under Microsoft Entra ID → Properties, retry, then revert it |
| Azure GreenOps lists subscriptions without the Carbon Optimization Reader role | The role is missing on those subscriptions, or the assignment hasn't propagated | Assign Carbon Optimization Reader to the Zation Platform Connector at Management Group level. Measured data appears with the next monthly sync. See Carbon Optimization Reader |
RBAC propagation can take up to 30 minutes after an assignment. Wait before you run Verify again.
Carbon Optimization Reader
Access denied on a subscription
Microsoft's API answers Denied per subscription where the role is missing. Assign Carbon Optimization Reader to the Zation Platform Connector at Management Group level so every subscription inherits it. Microsoft requires the permission at subscription level, so a role on a resource group or resource doesn't cover emissions data.
Error "Failed to send request to Microsoft.Carbon due to AAD authentication error"
The Enterprise App Prod-AzureSustainability is disabled in your tenant. Ask a tenant admin to enable it under Microsoft Entra ID → Enterprise applications.
No data right after granting the role
Microsoft registers a tenant the first time it uses the Carbon service. This can take 30 minutes to one hour.
The current month is missing
Microsoft publishes emissions for a month by the 19th day of the following month. New subscriptions and changed resource configurations appear in that later data.
Older months are missing
Microsoft keeps 12 months of emissions data.