Troubleshooting
List of common Issues
Agent Won't Run
"Insufficient privileges" or "Access denied"
The admin account needs the required Entra ID roles. Check the specific agent's Requirements page and verify all roles are assigned. Most agents need multiple roles (e.g., Compliance Administrator + Security Reader + Reports Reader).
"Agent not found" or "Cannot load agent"
Make sure the agent is properly deployed to your Security Copilot environment. Redeploy the agent manifest if necessary.
Missing or Incomplete Data
"No data available" or "Insufficient data for analysis"
Most agents need 30-90 days of historical data to provide meaningful insights. If you've recently deployed a service (Purview, Intune, PIM), wait for data to accumulate before running analysis.
Agent returns partial results
Check that all required data sources are configured and collecting data. For example:
Purview agents need active policies and classification data
Intune agents need enrolled devices and deployed policies
PIM agents need role activations occurring
Permission Problems
"Cannot access [service] data"
The admin who deployed the agent needs access to the specific service. For cross-service agents, verify permissions for all services being analyzed (e.g., Purview + Defender for Compliance Assistant).
Role assignments not working
Permissions can take 5-15 minutes to propagate after assignment. Wait a bit and try again. If issues persist, sign out and back in to refresh tokens.
Authentication Issues
"Authentication failed"
Because Entra Agent IDs aren't available yet, agents use the deploying admin's identity. Make sure:
The admin account has all required roles
The account hasn't been disabled or locked
MFA/Conditional Access isn't blocking authentication
High SCU Consumption
Agent uses more SCUs than expected
SCU estimates are based on typical environments. Larger tenants, longer time ranges, or more complex analyses will use more SCUs. To reduce consumption:
Use shorter time ranges when possible
For Classification Optimizer, use "quick" mode instead of "deep"
Limit scope to specific areas (e.g., analyze only DLP instead of all Purview policies)
Data Quality Issues
Results don't match what I see in the portal
Reports may be delayed 24-48 hours
The agent and portal might use different data sources or calculation methods
Check that you're comparing the same time ranges
Recommendations seem incorrect
Agents make recommendations based on available data and best practices. They may not have full context about your specific business requirements. Review recommendations carefully and adjust based on your needs.
Still Stuck?
If none of these help:
Check the specific agent's Requirements page for additional notes
Verify your Security Copilot subscription is active
Ensure the services being analyzed (Intune, Purview, Defender) are properly licensed and configured
Review the agent's changelog for known issues in your version
Last updated
Was this helpful?