Before you begin
- An Atlas AVD administrator account
- For fixes in Microsoft Entra ID and Azure: rights to grant admin consent for the Atlas app registration and to add role assignments on the subscription
1. "This account is not authorized" at sign-in
If someone sees This account is not authorized, they signed in to Microsoft successfully but don't have an Atlas role yet. An administrator adds them in User Administration (see step 12).
2. Run Post-Setup Validation
The best place to start is Post-Setup Validation, under Administration → Platform. It runs six checks (Azure connectivity, Microsoft Graph permissions, Key Vault, integrations, host pools and email) and shows how many passed, failed or were skipped. Select Run validation to check again at any time.
3. Read a failed check
Expand a failed check to see why. Azure connectivity failing with HTTP 403 means your app registration can't reach the subscription, which usually means a role is missing. Graph API permissions failing with HTTP 403 means admin consent hasn't been granted. Select Fix this to go straight to the fix.
4. See exactly which permissions are missing
Fix this opens the Permissions step of the setup wizard. Atlas checks every permission your app registration needs and shows a count for each area (Graph API, Defender ATP, Exchange Online, Security & Compliance, Entra roles and RBAC roles), with a row for every permission.
5. Grant admin consent in Entra ID
When Microsoft Graph permissions are missing, Atlas tells you what to do: in the Azure portal, go to Entra ID → App registrations → your Atlas app → API permissions, and select Grant admin consent.
6. Assign a missing Azure role
The RBAC Roles card lists the Azure roles the app registration needs. If one is missing, such as Reader on your subscription, add it in the Azure portal: open the subscription, then Access control (IAM) → Add role assignment.
7. Re-check, then run validation again
When you've made the changes, select Re-check on the Permissions step. Microsoft can take a few minutes to apply new permissions, so if something is still red, wait a moment and check again. Then go back to Post-Setup Validation and select Run validation. From its menu you can also copy the results or download a report for your records or for Atlas support.
8. Re-run the setup wizard
You can re-run the setup wizard any time from Administration → Platform → Setup Wizard. Atlas asks you to confirm first, because changes made in the wizard affect your live environment.
9. Replace an expired client secret
In the wizard, the app registration from your deployment is already filled in. If its client secret has expired, select Override with different credentials and enter a new one. Atlas asks before replacing the existing Application ID and Client Secret; choose Keep existing to leave them as they are.
10. Check a single tenant's access
You can also check each tenant on its own. Open the tenant from the Tenant List, then under Access Checks use Check APIs and Check IAM Roles. Each lists exactly what's granted and what's missing.
11. Invite guest users first
If someone from another organization sees Selected user account does not exist in tenant, they need to be invited as a guest first. In the Microsoft Entra admin center for your Atlas tenant, go to Users → New user → Invite external user, enter their email, then select Review + invite → Invite. They accept the invitation from their inbox.
For more detail, see Add a Guest / External User.
12. Add the user in Atlas
Then add them in Atlas. Open User Administration, select Add User, and enter the email address you invited. Choose a role (Read Only suits partners and clients) and the tenants they can see: All Tenants, or Specific Tenants. Select Add User. They show as pending until they first sign in.
13. "That region has no capacity on your subscription yet"
If deploying Atlas stops with this message, Azure App Service has no quota for that region on your subscription. Pick one of the suggested regions, or select Request capacity in this region. To do it yourself, open Quotas in the Azure portal, go to Compute and the Microsoft.Web provider, find Total Regional vCPUs, request at least 3, then select Deploy now again.
See Request an App Service Quota Increase for the full steps.
Still stuck?
Export a diagnostics bundle from Administration → Support and open a ticket, or email support@atlasavd.com.