Troubleshooting

The app stays on Starting

A low-cost deployment may need to wake PostgreSQL before serving organization data. Wait for the screen’s retry. If it does not recover, ask the operator to check the API readiness, database power state and database-wake identity permissions. Include the time and any displayed correlation ID.

Sign-in fails or returns to the wrong hostname

Confirm you opened modelfence.ca and used the intended Microsoft account. The operator must keep the application’s base URL and Entra redirect URI aligned. For the custom domain, the callback is https://modelfence.ca/api/auth/callback and the signed-out URL is https://modelfence.ca/api/auth/signed-out.

AADSTS50011 indicates a redirect mismatch. Share the error code and requested hostname with the operator, not a token or session cookie. Administrators should use the repository’s sign-in configuration script after completing a domain cutover.

A feature or action is missing

Check the current organization, role and feature entitlement. Viewer cannot triage or export. Active assessments need Admin or Owner, the active-assessment entitlement and explicit scope authorization. A planned integration cannot be enabled by changing your role.

GitHub is connected but inventory is empty

Check the installation’s repository selection, supported filenames and latest scan statistics. Read gaps for missing access or unsupported configuration. A successful connection alone does not evaluate the repository.

A scan completed with gaps

Open its detail and address the specific prerequisite. Retry after a meaningful change, such as fixing App permissions or making a target reachable. An unchanged retry is unlikely to resolve an access denial. Do not treat a partial result as proof that a prior finding disappeared.

Runtime events do not arrive

1. Use the integration’s exact endpoint and current bearer token.
2. Confirm that the source is connected and its entitlement is enabled.
3. Check that event timestamps are current and event IDs are unique.
4. Inspect accepted, duplicates, rejected, errors and droppedAttributes in the response.
5. Compare sender and server clocks, and verify the environment and agent filters in Runtime.

Token rotation revokes the old token. Unsupported attributes may be dropped even when an event is accepted. See the ingestion example.

Not found or Not permitted

Verify that the link belongs to the selected organization. Not found can intentionally hide a resource in another organization. Not permitted indicates a permission or entitlement boundary. Ask an Owner to review your role instead of sharing another member’s session.

A policy save conflicts

Someone may have changed the policy since you opened it. Reload, compare the current version with your intended change, dry-run it and save with a reason. Do not overwrite another editor’s decision blindly.

What to include in a support request

Record the screen, operation, organization context, time, scan or finding ID and correlation ID if shown. Describe the expected behavior and what changed. Exclude runtime tokens, passwords, cookies and unredacted private source content.