Skip to main content
This page covers the most common issues you may encounter with RAIDEN and how to resolve them. If you work through the steps below and the problem persists, contact [email protected].

​
Connection issues

These issues typically surface during setup or after a permission change in your Microsoft 365 tenant.

​
Audit logging is not enabled

If the connection test fails with an error related to audit logs, Microsoft 365 audit logging may be turned off for your tenant. Fix: Go to Microsoft Purview → Audit → Start recording user and admin activity. Once enabled, return to RAIDEN and rerun the connection test.
Audit logging must be enabled before RAIDEN can ingest any events. This is a tenant-level setting in Microsoft Purview and is separate from RAIDEN configuration.
If the connection fails with a permissions or consent error, the account used to grant consent may not have the required role. Fix: The account completing the consent flow must be a Global Administrator in your Microsoft 365 tenant. Sign out of Microsoft, sign back in with a Global Administrator account, and repeat the consent steps in RAIDEN. RAIDEN requires consent to two separate Microsoft APIs. If you completed the first consent (Microsoft Graph) but the second consent screen (Office Management Activity API) was skipped or dismissed, the connection will be incomplete. Fix: Go to Settings → Connection and click Reconnect M365 to restart the consent flow from the beginning. Complete both consent screens.

​
Unverified publisher warning from Microsoft

During the consent flow, Microsoft may display an “Unverified publisher” warning on the consent screen.
This warning is expected and does not indicate a security risk. RAIDEN is in early access and Microsoft publisher verification is in progress. Click Accept to continue.

​
Detections not appearing

If RAIDEN is connected but you are not seeing alerts or cases, use the steps below to diagnose the issue.

​
Check the last poll time and event count

Go to Settings → Connection. This view shows the last time RAIDEN successfully polled your audit log and how many events were ingested.
  • If the last poll time is recent and the event count is non-zero, RAIDEN is working normally. Detections only appear when the audit log contains activity that matches a detection rule.
  • If no events have been ingested in the last 30 minutes, check the connection status on the same page.

​
First-time setup — allow time for the initial poll

After connecting, RAIDEN processes the last 24 hours of audit logs in its first poll. Findings typically appear within 5–10 minutes, depending on the volume of activity in your tenant.
If you connected recently and are not yet seeing detections, wait 10 minutes and then refresh the Cases and Alerts views before raising a support request.

​
Hybrid AD issues

These issues are specific to environments where on-premises Active Directory is synced to Microsoft 365 via Azure AD Connect (Entra Connect).

​
Auto-disable did not fully stop a compromised AD-synced account

RAIDEN’s auto-disable creates a Conditional Access block in Entra ID for AD-synced accounts. This stops M365 sign-ins but does not disable the on-prem AD account. Fix: Disable the account in on-prem Active Directory manually:
  • ADUC: Active Directory Users and Computers → find the user → right-click → Disable Account
  • PowerShell: Disable-ADAccount -Identity <samAccountName>
Also revoke active M365 sessions from the case view using the Revoke Sessions response action.
A Conditional Access block alone does not prevent local network authentication (e.g., workstations, file servers, internal applications). Always disable the on-prem account for full containment.

​
Response action failed for an AD-synced account

If a Conditional Access block response action fails for an AD-synced user, the most common causes are:
  • Insufficient permissions — confirm RAIDEN has Policy.ReadWrite.ConditionalAccess consent. Check Settings → Connection → Permissions and rerun consent if needed.
  • Conditional Access already applied — a CA policy for this user may already exist. Check the Microsoft Entra admin centre under Protection → Conditional Access → Policies.
  • Account no longer synced — if the Azure AD Connect sync was disabled or the account deleted from on-prem AD, the Entra account may be in an inconsistent state. Check Azure AD Connect Health.

​
AD-synced users are not appearing in RAIDEN detections

RAIDEN discovers users from the audit log activity it ingests — not from a user directory sync. A user will appear in RAIDEN only once they have M365 audit log activity (sign-ins, file access, etc.). Fix: Confirm the user has active M365 usage and that audit logging is enabled in Microsoft Purview. If the user has not performed any auditable M365 actions, they will not appear until they do.

​
Account & access issues

​
Invite email not received

If a team member did not receive their invite email, it has likely been filtered by their mail system. Fix: Ask the affected user to check their junk or spam folder. If the email is not there, contact your RAIDEN onboarding contact to have the invite resent. Invite links are valid for 7 days from the time they are generated. If a user tries to use an expired link, they will see an error. Fix: An Owner or Admin can generate a new invite link from Settings → Team. Locate the user in the Pending Invites list and regenerate the link.

​
Contacting support

If you cannot resolve an issue using this guide, email [email protected]. RAIDEN support responds within 1 business day for standard queries. When writing your support request, include:
  • Your organisation name or tenant slug (shown in Settings → Account)
  • The Case or Alert ID if your question is about a specific detection
  • A brief description of what you expected to see and what you saw instead
If you are dealing with an active compromise, include URGENT in the subject line of your email. Urgent requests are prioritised over standard queries.