Skip to main content

Troubleshooting

This article covers issues you may run into during SaaS onboarding and during ongoing SaaS scans. For Cloud Scanner-specific runtime issues, see also the Cloud Scanner troubleshooting guide in the Components section of the Upwind Documentation Center.

Common onboarding issues​

Preflight script reports missing permissions​

Symptom: The upwindctl azure onboarding preflight --is-saas command in Step 2 reports one or more permission failures.

Likely cause: The identity running the preflight script does not have the Azure permissions described in the Prerequisites, or it is logged in to the wrong tenant or subscription.

How to fix:

  1. Re-run az login and confirm with az account show that your terminal session is using the correct identity and tenant.
  2. Inspect the exact check the preflight script reports as failing, and verify the identity has the corresponding Entra role or Azure role assignment.
  3. To onboard at the tenant or management-group scope, confirm you have elevated access to manage the tenant root and hold the required role at that scope.
  4. Re-run the preflight script. Proceed to Step 3 only once it passes.

Terraform apply fails​

Symptom: terraform init && terraform apply in Step 3 fails before completing.

Likely causes:

  • The identity running Terraform cannot create app registrations in your Entra tenant (required when using the Create a new Service Principal option).
  • The identity running Terraform cannot create role assignments at the connected scope.
  • A previous attempt left behind identities or role assignments with conflicting names.

How to fix:

  1. Review the first error in the Terraform output to identify the failing resource and action.
  2. Verify the identity meets the Prerequisites - in particular the Entra role needed to create app registrations and the role-assignment permissions at the connected scope.
  3. If your organization restricts app registration creation, switch to the Use an existing Service Principal option in Step 3 and supply the object IDs of pre-created service principals.
  4. Remove any conflicting leftovers from previous attempts, then re-run terraform init && terraform apply.

Validation fails at Validate & continue​

Symptom: Clicking Validate & continue in Step 3 returns an error.

Likely causes:

  • The Terraform apply or ARM deployment has not finished yet, or completed with errors.
  • When using an existing Service Principal, the object IDs entered do not match the service principals that hold the required role assignments (for example, an application ID was entered instead of the service principal object ID).
  • The required role assignments were not created at the connected scope.

How to fix:

  1. Confirm the deployment from Step 3 completed successfully, then re-run validation.

  2. If you brought your own service principals, verify you entered the object ID of each service principal - not the application (client) ID. You can look it up with:

    az ad sp show --id <application-client-id> --query id -o tsv

  3. Verify the role assignments exist at the scope you connected, then click Validate & continue again.

  4. If validation still fails, re-run the deployment from the onboarding center so the identities and role assignments are recreated with the parameters Upwind injected for your session.

Ongoing scanning issues​

Subscriptions are missing from scan coverage​

Symptom: Some subscriptions do not appear in scan results or show as not scanned.

Likely causes:

  • The subscriptions were not brought into scope in Step 4.
  • The subscriptions are outside the connection scope selected in Step 1 (for example, they sit under a management group that was not connected).

How to fix:

  1. Review the scope in the Organizations and accounts settings and enable scanning for the missing subscriptions.
  2. If the subscriptions are outside the connected scope, extend the connection scope so they are discovered.

Revoked or broken access​

Symptom: Scans stop completing for the whole environment, and Upwind reports it can no longer access your tenant.

Likely causes:

  • The Upwind service principals were deleted from your Entra tenant, or their role assignments were removed.
  • The Orchestrator Subscription was deleted or disabled.

How to fix:

  1. Check whether the Upwind service principals still exist in your Entra tenant and hold their role assignments at the connected scope.
  2. Confirm the Orchestrator Subscription designated in Step 1 still exists and is active.
  3. If access was removed intentionally and you want to reconnect, re-run the Step 3 deployment from the onboarding center to restore the identities and role assignments.

If you run into an issue you cannot resolve, contact support@upwind.io.