> ## Documentation Index
> Fetch the complete documentation index at: https://docs.raidenhq.com/llms.txt
> Use this file to discover all available pages before exploring further.
# RAIDEN troubleshooting: connections, detections, and access
> Step-by-step fixes for common RAIDEN issues — Microsoft 365 connection failures, missing detections, invite problems, and how to reach support.
This page covers the most common issues you may encounter with RAIDEN and how to resolve them. If you work through the steps below and the problem persists, contact [support@raidenhq.com](mailto:support@raidenhq.com).
***
## Connection issues
These issues typically surface during setup or after a permission change in your Microsoft 365 tenant.
### Audit logging is not enabled
If the connection test fails with an error related to audit logs, Microsoft 365 audit logging may be turned off for your tenant.
**Fix:** Go to [Microsoft Purview](https://purview.microsoft.com) → **Audit** → **Start recording user and admin activity**. Once enabled, return to RAIDEN and rerun the connection test.
Audit logging must be enabled before RAIDEN can ingest any events. This is a tenant-level setting in Microsoft Purview and is separate from RAIDEN configuration.
### Insufficient privileges during consent
If the connection fails with a permissions or consent error, the account used to grant consent may not have the required role.
**Fix:** The account completing the consent flow must be a **Global Administrator** in your Microsoft 365 tenant. Sign out of Microsoft, sign back in with a Global Administrator account, and repeat the consent steps in RAIDEN.
### Second consent not completed
RAIDEN requires consent to two separate Microsoft APIs. If you completed the first consent (Microsoft Graph) but the second consent screen (Office Management Activity API) was skipped or dismissed, the connection will be incomplete.
**Fix:** Go to **Settings → Connection** and click **Reconnect M365** to restart the consent flow from the beginning. Complete both consent screens.
### Unverified publisher warning from Microsoft
During the consent flow, Microsoft may display an "Unverified publisher" warning on the consent screen.
This warning is expected and does not indicate a security risk. RAIDEN is in early access and Microsoft publisher verification is in progress. Click **Accept** to continue.
***
## Detections not appearing
If RAIDEN is connected but you are not seeing alerts or cases, use the steps below to diagnose the issue.
### Check the last poll time and event count
Go to **Settings → Connection**. This view shows the last time RAIDEN successfully polled your audit log and how many events were ingested.
* If the last poll time is recent and the event count is non-zero, RAIDEN is working normally. Detections only appear when the audit log contains activity that matches a detection rule.
* If no events have been ingested in the **last 30 minutes**, check the connection status on the same page.
### First-time setup — allow time for the initial poll
After connecting, RAIDEN processes the last 24 hours of audit logs in its first poll. Findings typically appear within **5–10 minutes**, depending on the volume of activity in your tenant.
If you connected recently and are not yet seeing detections, wait 10 minutes and then refresh the Cases and Alerts views before raising a support request.
***
## Hybrid AD issues
These issues are specific to environments where on-premises Active Directory is synced to Microsoft 365 via Azure AD Connect (Entra Connect).
### Auto-disable did not fully stop a compromised AD-synced account
RAIDEN's auto-disable creates a Conditional Access block in Entra ID for AD-synced accounts. This stops M365 sign-ins but does not disable the on-prem AD account.
**Fix:** Disable the account in on-prem Active Directory manually:
* **ADUC**: Active Directory Users and Computers → find the user → right-click → **Disable Account**
* **PowerShell**: `Disable-ADAccount -Identity `
Also revoke active M365 sessions from the case view using the **Revoke Sessions** response action.
A Conditional Access block alone does not prevent local network authentication (e.g., workstations, file servers, internal applications). Always disable the on-prem account for full containment.
### Response action failed for an AD-synced account
If a Conditional Access block response action fails for an AD-synced user, the most common causes are:
* **Insufficient permissions** — confirm RAIDEN has `Policy.ReadWrite.ConditionalAccess` consent. Check **Settings → Connection → Permissions** and rerun consent if needed.
* **Conditional Access already applied** — a CA policy for this user may already exist. Check the Microsoft Entra admin centre under **Protection → Conditional Access → Policies**.
* **Account no longer synced** — if the Azure AD Connect sync was disabled or the account deleted from on-prem AD, the Entra account may be in an inconsistent state. Check Azure AD Connect Health.
### AD-synced users are not appearing in RAIDEN detections
RAIDEN discovers users from the audit log activity it ingests — not from a user directory sync. A user will appear in RAIDEN only once they have M365 audit log activity (sign-ins, file access, etc.).
**Fix:** Confirm the user has active M365 usage and that audit logging is enabled in Microsoft Purview. If the user has not performed any auditable M365 actions, they will not appear until they do.
***
## Account & access issues
### Invite email not received
If a team member did not receive their invite email, it has likely been filtered by their mail system.
**Fix:** Ask the affected user to check their **junk or spam folder**. If the email is not there, contact your RAIDEN onboarding contact to have the invite resent.
### Invite link has expired
Invite links are valid for **7 days** from the time they are generated. If a user tries to use an expired link, they will see an error.
**Fix:** An **Owner** or **Admin** can generate a new invite link from **Settings → Team**. Locate the user in the Pending Invites list and regenerate the link.
***
## Contacting support
If you cannot resolve an issue using this guide, email [support@raidenhq.com](mailto:support@raidenhq.com). RAIDEN support responds within **1 business day** for standard queries.
When writing your support request, include:
* Your **organisation name or tenant slug** (shown in Settings → Account)
* The **Case or Alert ID** if your question is about a specific detection
* A brief description of **what you expected to see and what you saw instead**
If you are dealing with an **active compromise**, include **URGENT** in the subject line of your email. Urgent requests are prioritised over standard queries.