Troubleshoot app permission errors for Microsoft OneDrive and Office 365 email

Overview

If the Incydr Microsoft OneDrive or Office 365 email data connection has been deauthorized in the Incydr console, or if the Incydr application has been removed from your Microsoft Azure environment, the Incydr connection enters an Error status and this error message appears in the details for that data connection:

The Incydr/Code42 enterprise application in your Microsoft Azure account does not have the right permissions or has been deleted. Deauthorize this data connection and set up a new data connection.

To troubleshoot this error, verify whether the Incydr/Code42 application exists in Microsoft Azure.

• If the application still exists, grant admin consent to reset its permissions.
• If the application no longer exists, deauthorize the connection in Incydr and set up a new data connection.

Affects

• Incydr OneDrive data connections
• Incydr Office 365 email data connections

Verify the Incydr/Code42 application exists in Microsoft Azure

1. Log in to portal.azure.com.
2. Click Azure Active Directory.
3. Click Enterprise Applications.
4. In the Enterprise applications list, look for an application with a name starting with "Code42."
   • For OneDrive, look for the "Code42 Cloud Services" enterprise application.
   • For Microsoft Office 365 email, look for the "Code42 Email Data Connector" enterprise application.
5. If the application is listed, continue to the next section to grant admin consent to reset its permissions. If it is not listed, deauthorize the connection in the Incydr console and set up a new data connection.

If the app exists, grant admin consent to it in Microsoft Azure

If the application exists in Microsoft Azure, follow these steps to grant admin consent to reset its permissions:

1. Click the application name in the Enterprise applications list to open its details.
2. Under Security in the left navigation pane, click Permissions.
3. Click Grant admin consent for Code42 to reset the application's permissions to those required for monitoring.
   After you grant the application permissions, Incydr detects the change and returns the connection to the Monitoring status within 24 hours. You have resolved the error and are finished with troubleshooting.

If the app doesn't exist, deauthorize the connection and set up a new one

If the application does not exist in Microsoft Azure, set up a new Incydr connection to your Microsoft environment.

1. Sign in to the Incydr console.
2. Select Administration > Integrations > Data Connections. 
3. Locate the service to deauthorize in the table, then click View details .
4. Click Deauthorize.
5. Set up a new Incydr OneDrive cloud storage or Microsoft Office 365 email service connection using your Microsoft 365 administrator credentials.

External resources

Microsoft documentation: Grant tenant-wide admin consent to an application

Related topics

• Connect Incydr to OneDrive
• Connect Incydr to Microsoft Office 365 email
• Deauthorize and resume monitoring a data connection