# Troubleshooting {% hint style="info" %} Need help or have questions regarding the agent? E-Mail us at {% endhint %} ### Agent Won't Run **"Insufficient privileges" or "Access denied"** The admin account needs the required Entra ID roles. Check the specific agent's Requirements page and verify all roles are assigned. Most agents need multiple roles (e.g., Compliance Administrator + Security Reader + Reports Reader). **"Agent not found" or "Cannot load agent"** Make sure the agent is properly deployed to your Security Copilot environment. Redeploy the agent manifest if necessary. ### Missing or Incomplete Data **"No data available" or "Insufficient data for analysis"** Most agents need 30-90 days of historical data to provide meaningful insights. If you've recently deployed a service (Purview, Intune, PIM), wait for data to accumulate before running analysis. **Agent returns partial results** Check that all required data sources are configured and collecting data. For example: * Purview agents need active policies and classification data * Intune agents need enrolled devices and deployed policies * PIM agents need role activations occurring ### Permission Problems **"Cannot access \[service] data"** The admin who deployed the agent needs access to the specific service. For cross-service agents, verify permissions for all services being analyzed (e.g., Purview + Defender for Compliance Assistant). **Role assignments not working** Permissions can take 5-15 minutes to propagate after assignment. Wait a bit and try again. If issues persist, sign out and back in to refresh tokens. ### Authentication Issues **"Authentication failed"** Because Entra Agent IDs aren't available yet, agents use the deploying admin's identity. Make sure: * The admin account has all required roles * The account hasn't been disabled or locked * MFA/Conditional Access isn't blocking authentication ### High SCU Consumption **Agent uses more SCUs than expected** SCU estimates are based on typical environments. Larger tenants, longer time ranges, or more complex analyses will use more SCUs. To reduce consumption: * Use shorter time ranges when possible * For Classification Optimizer, use "quick" mode instead of "deep" * Limit scope to specific areas (e.g., analyze only DLP instead of all Purview policies) ### Data Quality Issues **Results don't match what I see in the portal** * Reports may be delayed 24-48 hours * The agent and portal might use different data sources or calculation methods * Check that you're comparing the same time ranges **Recommendations seem incorrect** Agents make recommendations based on available data and best practices. They may not have full context about your specific business requirements. Review recommendations carefully and adjust based on your needs. ### Still Stuck? If none of these help: 1. Check the specific agent's Requirements page for additional notes 2. Verify your Security Copilot subscription is active 3. Ensure the services being analyzed (Intune, Purview, Defender) are properly licensed and configured 4. Review the agent's changelog for known issues in your version --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://agents.glueckkanja.com/troubleshooting.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.