Troubleshooting

Start with the place that shows the problem, then check the log (C:\IntensiveReportsLogs\ unless you changed LoggingRootPath). As an administrator, Settings > Data & cache and PowerShell Diagnostics show most causes without the log.

The site does not start

Symptom	Cause	Fix
IIS error HTTP Error 500.19	the ASP.NET Core Hosting Bundle is missing, or was installed before IIS	install the ASP.NET Core 10 Hosting Bundle, then run `iisreset`
HTTP Error 500.30 or 500.31	the app failed while starting	check the log and the Windows Application event log. Common causes: a syntax error in `appsettings.json` (a missing comma or quote, single backslashes in paths), or the app pool cannot write the log folder.
Bad Request - Invalid Hostname	`AllowedHosts` does not contain the host name in the address bar	add it to `AllowedHosts` (Configuration)
Service Unavailable (503)	the app pool stopped, often after repeated start failures	fix the cause in the log, then start the app pool
a page that says the site is being updated	`app_offline.htm` is still in the site folder	delete it (Updating)

A failed sign-in ends on the Sign-in failed page. It shows the error code and how to fix it. Microsoft’s full message is in the log (line Sign-in failed (<code>)).

Code	Cause	Fix
`AADSTS50011`	the address in the browser is not a redirect URI of the app registration	add `https://<your-host>/signin-oidc` exactly as people open the site, including an application path (Entra app registration)
`AADSTS700054`	ID tokens are not enabled	tick ID tokens under Authentication in the app registration
`AADSTS700016`	the application is not found	`EntraID:ClientId` or `EntraID:TenantId` is wrong
`AADSTS50194`	the registration accepts only its own tenant, but sign-in used the multi-tenant endpoint	set `EntraID:TenantId` to your tenant ID (or `MsGraphCredentials:TenantId` to the tenant GUID)
`AADSTS65001`	consent is missing	an administrator grants it under Enterprise applications > IntensiveReports > Permissions
`AADSTS7000215`, `AADSTS7000222`	the client secret is wrong or expired	create a new secret (Operations); paste the secret’s Value, not its ID
`IDX10214`	the token was issued for another application ID	`EntraID:ClientId` must be exactly the application (client) ID
`correlation`, `IDX21323`	the browser lost the sign-in cookie (sign-in took too long, was started on another address, or the app restarted meanwhile)	close the tab and sign in again from the start page

Signed in, but the app refuses access: with ReaderRoles set, the user needs one of those app roles; this also applies to administrators (Sign-in and access). Users of other tenants are always refused.

Settings cannot be saved: only administrators can save settings marked Everyone (Global Administrator or the IR.Admin role, signed in). If an administrator gets Could not save, the app pool cannot write App_Data (Installation).

A report shows a red load error

The box This report could not be loaded names the error from Microsoft. Usual causes:

Error mentions	Cause	Fix
`403`, Forbidden, Authorization_RequestDenied, insufficient privileges	a permission is missing	the report’s ? button lists the permissions it needs (all permissions). Run `Grant-IrPermissions.ps1` again, with the switch the report needs if it is an optional permission. Exchange Online and SharePoint can need 30 minutes; then recycle the app pool.
a licence, not licensed, tenant does not have	your tenant lacks the licence	the ? button names the licence. Without it, Microsoft has no data for the report.
`429`, throttled, too many requests	Microsoft Graph throttling	press Refresh later; if it happens often, choose a slower refresh pace (Data and cache)
a role, Global Reader, Compliance Administrator, Teams Administrator	a directory role is missing	see Entra app registration

A report is empty

It may be right. Many reports list problems; an empty list then means nothing was found. The report’s page in the report reference says when an empty result is the expected good outcome.
The data is switched off. The report then says Data switched off and names the data source. An administrator switches it on again under Settings > Data & cache (Fetch).
It is a scan. It stays empty until someone presses Run scan, and after every restart.
The data is still loading after a restart. The header shows Refreshing while data loads.
A licence is missing for data that Microsoft returns as an empty list instead of an error. Check the licence under the report’s ? button.

Exchange, SharePoint, Teams or Purview reports fail, Graph reports work

These reports read through PowerShell and sign in with the certificate. Open PowerShell Diagnostics and press Run probe: it shows the exact error.

Cause	Fix
the certificate is not uploaded to the app registration, or the thumbprint in `appsettings.json` is wrong	compare the thumbprint in the app registration, in `certlm.msc` and in `MsGraphCredentials:CertificateThumbprint`
the app pool cannot read the private key	run `New-IrCertificate.ps1` with the right `-AppPoolIdentity`, or grant Read in `certlm.msc` > Manage Private Keys
the certificate expired	renew it
only Exchange and Purview say certificate not found	set the app pool’s Load User Profile to True
Get-PnP… or Connect-PnPOnline is not recognised	the modules were installed for Windows PowerShell or for one user only. Run `Install-IrModules.ps1` in PowerShell 7 as administrator.
`MsGraphCredentials:TenantDomain` or `SparePointSite` is wrong	use `<tenant>.onmicrosoft.com` and `https://<tenant>-admin.sharepoint.com`
the Global Reader role was assigned less than 30 minutes ago	wait, then press Re-run warm-up (reconnect) in PowerShell Diagnostics or recycle the app pool

Exchange reports fail after a module update

The app and the Exchange Online module share some Microsoft sign-in libraries in one process, and only one version of each can be loaded. If the module on the server is newer than the libraries IntensiveReports was built with, the Exchange connection fails, typically with a could not load file or assembly error in PowerShell Diagnostics.

Update the PowerShell modules only when a new version of IntensiveReports asks for it (Updating). If you updated already, install the previous module version for all users and remove the newer one:

Get-InstalledModule ExchangeOnlineManagement -AllVersions
Uninstall-Module ExchangeOnlineManagement -RequiredVersion <newer version>
Install-Module ExchangeOnlineManagement -RequiredVersion <previous version> -Scope AllUsers -Force

Then recycle the app pool.

Data disappears or reports are slow after a quiet period

IIS stopped the idle app pool, and the data in memory went with it. Set the pool to always running: .\setup\Set-IrIisAlwaysRunning.ps1 -SiteName <site> -Apply (Operations).

A PowerShell report or scan stops after a long time

A PowerShell script is stopped after 20 minutes. For very large tenants, raise IntensiveReportsConfig:PowerShellTimeoutMinutes (up to 120) and restart the app.

Report API and MCP errors

Status	Meaning	Fix
`404` on every address	the API is switched off	turn on Report API on Settings > API access
`404` for one report	the client has no access to the report’s area, the report is hidden for it, or the ID is wrong	check the client’s access and Never show these reports
`401`	the token is missing, wrong, expired or the client is disabled	issue a New token, check Expires and Enabled
`401` for a certificate client	the token’s audience is not the site’s address	set `IntensiveReportsConfig:Api:PublicUrl` and use that address as audience
`403`	the action is above the client’s access (refresh or scan with read access)	raise the client’s access for that area
`409`	the report’s data is switched off, or a scan was requested for a report that is not a scan	switch the data on, or use refresh
`429`	too many requests	wait for `Retry-After`; raise the limits in `appsettings.json` if a legitimate client needs more

Every call and refusal is in the audit log, App_Data\api-audit\<date>.jsonl.