> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tenantcore.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshooting

> Resolve common tenant, DNS, mailbox, Outlook, sending-integration, and reporting issues in TenantCore.

# Troubleshooting

Start troubleshooting from the TenantCore resource where the problem appears.

Avoid jumping directly into Microsoft, DNS-provider, or sending-platform admin portals until you confirm what TenantCore already knows about the state.

## Tenant will not connect

Check:

* you are signing in to the intended Microsoft tenant
* the account can grant the requested consent
* browser popup blocking is disabled for the flow
* the tenant is not already attached in a conflicting way
* TenantCore still has an available tenant slot

If consent was interrupted, restart the TenantCore connection flow.

## Tenant connected but automation is unavailable

Check:

* application permissions
* Exchange licence/readiness
* tenant service health
* whether a newer TenantCore permission set requires **Resync app**

Use the existing tenant re-consent workflow rather than disconnecting/reconnecting unless necessary.

## Domain is stuck waiting

Open the domain DNS details and check:

* Microsoft verification
* MX
* SPF
* DMARC
* DKIM
* provider provisioning state
* whether TenantCore is waiting on user action or Microsoft

DNS propagation can take time.

## Automatic DNS failed

Check:

* the DNS-provider connection still tests successfully
* the domain is in the connected provider account
* provider API eligibility
* existing DNS conflicts
* the provisioning run/job status

Correct the underlying issue and retry the failed provisioning job.

Use manual DNS if automation cannot proceed.

## Namecheap will not connect

Namecheap restricts API access to eligible accounts.

Confirm the account meets Namecheap's current API requirements and any required allowlisting is configured.

If not, use manual DNS.

## DKIM is not ready

DKIM often becomes available after the earlier Microsoft domain setup is complete.

Check:

* domain verification
* public DNS
* whether Microsoft has generated the DKIM CNAME targets
* whether both DKIM records are published
* whether TenantCore is waiting to enable DKIM

Do not invent DKIM targets from another domain.

## Mailbox creation failed

Check:

* the parent tenant is healthy
* the domain exists in that tenant
* mailbox capacity is available
* the address is not already in use
* Microsoft/Exchange permissions are healthy

Retry after the underlying condition is corrected.

## Password does not work

Check:

* whether the mailbox password was recently reset
* credential-vault sync state
* whether Microsoft requires a new sign-in condition
* whether the sending provider cached old credentials

Reset the mailbox password from TenantCore if necessary.

## MFA setup fails

Confirm you selected Microsoft's manual authenticator setup path:

1. add an Authenticator app
2. use a different authenticator application
3. choose **Can't scan the QR code?**
4. copy the manual secret into TenantCore
5. use the current TenantCore-generated code to complete verification

Do not reuse an expired six-digit code.

## Outlook access is not ready

Check:

* the selected Mailbox Access Account has an Exchange licence
* Full Access and Send As show as ready
* you signed in using the assigned access account
* Microsoft delegation has had time to propagate

Use TenantCore's repair/reapply workflow if the delegation does not become healthy.

## Sending integration is stuck on pending

A stale `pending` or `connecting` state from an interrupted browser session is retryable.

Try:

1. close any old provider/Microsoft popup
2. refresh TenantCore
3. open the mailbox connection again
4. choose **Retry connection**

If the mailbox is actively connected to another sending integration, disconnect the conflicting integration first.

## OAuth popup was closed

Closing the popup does not mean the mailbox should remain permanently locked.

Start the connection again from TenantCore.

Do not reuse an old OAuth URL or old `state` value.

## Provider test fails

Check:

* API key/token validity
* workspace/account access
* provider service status
* whether the credential was rotated
* whether the TenantCore integration belongs to the expected account

Re-save or rotate the provider credential where appropriate.

## Sending limit looks wrong

Check:

* configured TenantCore policy
* mailbox usage
* sending-platform daily limit
* Exchange enforcement state

TenantCore and the sending platform should not intentionally be configured with conflicting limits.

## Alert resolved before you saw it

Open **Reports → Activity Log**.

Resolved alerts may no longer require action, but their historical events can still explain what occurred.

## Scheduled report did not arrive

Check:

* the report schedule is enabled
* the configured recipient
* local schedule time
* spam/junk folder
* whether the reporting period contains data

A delivery problem does not remove the underlying report data.

## Need more context

When contacting support, include:

* TenantCore resource name
* tenant/domain/mailbox where relevant
* approximate time of the issue
* screenshot of the visible TenantCore state
* request ID if the issue came from the Complete API

Do not send plaintext mailbox passwords, MFA seeds, current TOTP codes, or provider API secrets in a support ticket.