Microsoft connection error messages

Admin

This page lists every message you can encounter while setting up the Microsoft connection — under Admin → System settings → “Microsoft Graph / SharePoint” and afterwards in day-to-day operation. For the setup itself: Set up the Microsoft/SharePoint connection.

Messages from “Connect to Microsoft” and “Test connection”

Both buttons report their result on the same line: “Connect to Microsoft” signs in and checks right afterwards, “Test connection” only silently checks an existing sign-in and never opens a sign-in window. Only the first message is a success. For the flow itself: Connect and test.

”Connection established. Access to sites and OneDrive.”

Everything is in place: organization consent has been granted, Sites.Read.All is available, and a SharePoint address is configured. Nothing to do.

”Access is in place. Your SharePoint address is still missing.”

Cause: The permissions are complete, but the “Your SharePoint address” field is empty.

Fix: Enter the address (e.g. https://contoso.sharepoint.com, one URL per line), save, then test again.

”Only your personal OneDrive can be searched, not team sites.”

Cause: The Sites.Read.All permission was not granted — often because a tenant administrator deliberately withheld it during consent.

This is not an error, it is a fallback. Nothing breaks: the connection keeps working, the file picker is simply limited to the personal OneDrive. Users see the note “Your account only has access to your personal OneDrive — no tenant-wide site access was granted.”

Fix, if team sites are wanted: Add Sites.Read.All to the app registration and grant admin consent again.

”Your organization has not granted access yet.”

Cause: The sign-in succeeded, but the application has no usable permission in your tenant — organization-wide consent is missing.

Fix: An account with administrator rights in your Microsoft organization clicks “Connect to Microsoft” again and ticks “Consent on behalf of your organization” in the Microsoft dialog. A regular user account cannot give this consent.

Below the message the hint “An administrator of your organization has to grant access once. Sign in as an administrator via ‘Connect to Microsoft’ and tick ‘Consent on behalf of your organization’, or open the approval page:” also appears — with the fallback button “Grant access for your organization”. It opens Microsoft’s approval page directly in the browser. That helps if you are not an administrator yourself: you can pass the address from the browser on to your IT. With quick start, a page on companywizard.eu then confirms the consent. Afterwards, “Connect to Microsoft” again.

”No SharePoint access token could be obtained for … with the account ….”

In full: “No SharePoint access token could be obtained for <address> with the account <account>. Either the address belongs to a different organization than the account, or your organization has not granted SharePoint access yet, or the sign-in has expired. Check the organization consent; otherwise disconnect the Microsoft account and test again.”

Cause: The Microsoft sign-in is in place, but no access comes about for the SharePoint address entered. The message itself names the three possible reasons.

Fix: First hold the address against the account — the line “Connected as … (tenant …).” shows which organization you are signed in to. If both match, grant the organization consent as above. If that does not help, disconnect the Microsoft account (on the desktop “Disconnect Microsoft account”, on the web “Disconnect” on the card on the Knowledge sync tab) and connect again.

”Not connected. Click ‘Connect to Microsoft’ first.”

Cause: There is no sign-in — never connected, disconnected, or the stored sign-in has expired or was revoked. “Test connection” never signs in by itself; the test only tells you that nothing is there.

Fix: “Connect to Microsoft”.

Cause: The sign-in while connecting was not carried through: sign-in window or browser tab closed, cancelled on the Microsoft page — or no answer for 3 minutes. Nothing has been changed; the page is usable again right away, no restart is needed.

This message exists on the desktop. On the web the whole page moves over to Microsoft; a cancellation there is reported afterwards by the card on the Knowledge sync tab: “Connecting your Microsoft account failed or was cancelled. Please try again.”

Fix: Connect again. If it keeps failing, check under AADSTS50011 further down whether the registration’s redirect URI matches your installation’s address.

Hints at the buttons

Not errors but states — they explain why a button cannot be used right now.

Grey hint below the locked “Test connection”: no Microsoft account is connected yet. → “Connect to Microsoft”.

Grey hint below the locked “Test connection”: the form has unsaved changes — including when CompanyWizard itself filled in the tenant ID from the sign-in. → “Save”; on the web, reload the page afterwards if the hint “Client ID changed …” appears.

”Connecting to Microsoft…”

The label of “Connect to Microsoft” while the sign-in runs. On the desktop CompanyWizard waits at most 3 minutes for the browser; after that, the cancellation message above appears.

”Connect to Microsoft” is greyed out

Desktop only, and deliberate: the connection is proven — account connected, result “Connection established. …”, nothing unsaved. “Disconnect Microsoft account”, a change in the form or a different test result enable the button again. To connect a different account: disconnect, then connect.

Appears on the desktop after “Disconnect Microsoft account” — and after saving a SharePoint address that belongs to a different organization: CompanyWizard discards the sign-in then, because it does not apply to the new organization. → “Connect to Microsoft”.

Browser page “Anmeldung erfolgreich” / “Anmeldung fehlgeschlagen”

Desktop only: after connecting, the system browser shows a page from CompanyWizard, headed in German with an English line below. “Anmeldung erfolgreich” (“You are signed in”) means the window can be closed, CompanyWizard has the sign-in. “Anmeldung fehlgeschlagen” (“Sign-in did not complete”) shows Microsoft’s error code and description underneath — usually one of the error codes below. Close the window, fix the cause, connect again.

Further messages on the settings page

A genuine failure, as opposed to a cancellation. The appended text is Microsoft’s original message; it starts with the error code. The two most common by far are below.

Cause: No application ID has been entered yet, so there is nothing to test. In practice this only affects web installations before initial setup.

Fix: Exactly what the message says — enter an application ID first, save, reload the page, then “Connect to Microsoft”.

Cause: In “Your own app” mode you clicked the fallback button “Grant access for your organization” without an application ID being entered. The consent address is built from that ID.

Fix: Enter the application ID and save, then “Connect to Microsoft” — an administrator grants the consent there by ticking “Consent on behalf of your organization”.

”Quick start is not available in this installation …”

Cause: Not an error but a limitation: the installation is not running as a desktop app. Quick start only works there. → Which path applies to me?

Fix: Choose “Your own app”.

”Client ID changed — reload the page …”

Cause: Web only: a changed application ID, tenant ID or a different mode was saved. The page’s Microsoft wiring, however, is set up as the page loads — using whichever values are stored at that moment; the new ones only take effect after a reload.

Fix: Reload the page, then “Connect to Microsoft”. No restart needed.

”Warning: after switching, all existing Microsoft connections must be re-established.”

A warning shown before saving, not an error. It appears as soon as you change the mode. What happens afterwards is described under Changing things later.

Messages from the provisioning assistant

These messages only appear in mode “Your own app” on a desktop installation, after you clicked “Create registration automatically”. → Path B automatic

”Your directory already contains a registration named ‘CompanyWizard’ with the application ID …”

In full: “Your directory already contains a registration named “CompanyWizard” with the application ID <ID>. Does it belong to this installation? Then enter <ID> above under Application ID and start the assistant again — it will complete that one. Otherwise rename the existing registration in Entra so a new one can be created here. Nothing was changed.”

Cause: The assistant found a registration of that name whose application ID is not the one entered in the form above. It cannot know whether it belongs to this installation — so it neither creates a second one nor touches the existing one.

Fix: As stated in the message. If it does belong: enter the application ID it named above and start the assistant again — your entry is the confirmation. If it does not: rename the existing registration in Entra.

Important: Nothing was changed. This message is a clean stop, not a half-finished run.

”Your directory already contains several registrations named ‘CompanyWizard’ …”

Cause: As above, but with several matches. The message lists every application ID it found.

Fix: Enter the application ID you want above and start the assistant again — it will complete exactly that one. Again, nothing was changed.

”The elevated write access could not be revoked.”

In full: “The elevated write access could not be revoked. Please check the Entra portal under Enterprise applications → CompanyWizard → Permissions and remove it there.”

Cause: The assistant withdrew the two borrowed permissions (Application.ReadWrite.All, DelegatedPermissionGrant.ReadWrite.All), but the subsequent read-back did not confirm that they are really gone — or the withdrawal itself failed. Or Microsoft had still not shown the freshly granted consent after about 30 seconds, so the assistant could not withdraw it at all. The application would rather report this state than claim an unverified success.

Fix — by hand, and promptly:

In the Entra portal → Enterprise applications → CompanyWizard → Permissions.
Remove the entries Application.ReadWrite.All and DelegatedPermissionGrant.ReadWrite.All.
Leave the remaining read permissions in place — the connection needs those.

Whatever the assistant created up to that point stays valid; the registration is fine. This is only about the borrowed rights. → The borrowed write access

”The assistant was cancelled. Nothing further was changed.”

Cause: The elevated sign-in was closed or declined before it completed.

Fix: Try again — or create the registration by hand. A cancellation has no consequences.

”The registration could not be created: …”

Cause: A genuine failure while creating it. The appended text is Microsoft’s original message. The most common triggers: your account does not hold the Global Administrator or Application Administrator role, or a policy in your tenant forbids creating app registrations.

Fix: Check the role (the hint under the button names the requirement), then try again. If it persists, the manual path leads to the same result.

About the borrowed rights: the message also tells you whether the elevated write access could be handed back. If it says that failed, proceed as for the cleanup message above.

”Registration created. Please save now.”

Not an error, but the single most important sentence of the whole flow: the assistant only filled in the fields above. Without saving, nothing is applied — the registration exists in Entra, but CompanyWizard does not use it.

Microsoft error codes (AADSTS)

`AADSTS50011` — redirect URI mismatch

In full: The redirect URI specified in the request does not match the redirect URIs configured for the application.

Cause: The address CompanyWizard uses to identify itself to Microsoft is not registered in the app registration — or not registered exactly like that. By far the most common trigger: a retyped or guessed redirect URI.

Fix: In Entra, under Authentication, register exactly the addresses shown in the form as copy fields under “Redirect URIs for the registration”:

Your installation	Platform in Entra	Redirect URI
Desktop	Mobile and desktop applications	`http://localhost`
Web	Web	`https://<your-host>/api/integrations/microsoft/callback`

The web address ends in /api/integrations/microsoft/callback. A different path produces exactly this error — for every user, every time.

Other pitfalls: a missing or superfluous https://, a trailing /, the wrong host name (internal instead of public), or the right address registered under the wrong platform.

An older registration may additionally carry the platform Single-page application (SPA) with .../msal-redirect.html. It is no longer needed and does no harm either — for cleaning it up see Add the redirect URIs.

`AADSTS700016` — application unknown in the tenant

In full: Application with identifier ’…’ was not found in the directory.

Cause: The application ID is not known in your tenant. Typical cases:

A typo in the application ID.
The ID comes from a different tenant (for example a test rather than production environment).
The registration exists, but admin consent has never been granted — so the application was never created in the tenant.
The registration was deleted.

Fix: Check the application ID against the Entra overview page and save, then, as an administrator, “Connect to Microsoft” and tick “Consent on behalf of your organization” in the Microsoft dialog.

Error messages in day-to-day operation

These messages do not appear in system settings, but they hang off the same connection.

Message	Cause / fix
”SharePoint not configured. The folder for this source can only be chosen once Microsoft Graph is set up.”	The connection has not been set up yet → Set up.
”SharePoint import is currently unavailable.” / “The SharePoint folder picker is currently unavailable.”	No valid token can be obtained. Use “Test connection” to determine the situation and look it up above.
”The owner’s Microsoft connection has expired or was revoked.”	A synced source is paused. The owner of the configuration must reconnect their Microsoft account; other syncs keep running. → Set up knowledge sync
”Not connected to Microsoft. Connect your Microsoft account above under …”	Not an error, but the hint in the sync editor: on the web the folder picker uses the connection from the “Microsoft connection for scheduled SharePoint syncs” card. Connect there, then pick again. The editor deliberately does not redirect by itself — that would discard the unsaved configuration.
”Connected as …, but without SharePoint permission. Connect again to grant it.”	The connection dates from before the move to a single Microsoft sign-in and carries calendar permissions only. Click “Connect again” on the card once — the SharePoint permission is granted in the same consent.
”Signed in to Microsoft. Click … again”	Not an error, and desktop only: the sign-in was the first step, the second click opens the picker. On the web the page moves over to Microsoft instead and comes back afterwards.
”The selected items returned no download link and were skipped.”	Affects items SharePoint does not hand out as files (e.g. shortcuts or OneNote sections). Check the file type.

If none of this fits

Sign-in works but no sites are visible: usually the OneDrive fallback above — verify with “Test connection”.
It fails for some users but not others: the connection is fine; that account lacks permissions in SharePoint itself. CompanyWizard only ever sees what the user may already see → What access the application has.
Everything stops at once: often an expired client secret (web installations only) or a changed application ID.