Skip to main content

Troubleshooting

Symptoms, causes, and fixes for the problems that come up most. Work top to bottom within each section; the causes are ordered by likelihood.

Credential and Connectivity​

A new credential does not work​

Credentials are stored without a connectivity test, so a bad credential shows up at first use: workspace discovery finds nothing, or the first scan fails.

  1. Azure: secret ID pasted instead of secret value. The value is only shown once at creation; if you copied the ID, create a new secret and update the credential.
  2. Role assignment not propagated. Azure role assignments can take a few minutes. Wait and retry discovery.
  3. Wrong tenant ID. Verify against the App Registration overview page.

Workspace shows a connectivity error​

  1. Open the workspace detail page and read the exact error
  2. Expired secret: rotate it (Managing credentials)
  3. Permission revoked: confirm the service principal still has the role assignment (Azure) or workspace admin access (AWS)
  4. After fixing the cause at the provider, the next scan uses the corrected credential

Auto-discovery finds no workspaces​

  • The role is assigned at resource-group scope, not subscription scope. Subscription scope is required to discover across the subscription.
  • The subscription has no Databricks workspaces the principal can read.
  • Already-enrolled workspaces are filtered out of discovery by design; nothing new to find is not an error.

Scans and Findings​

No findings appear​

  1. No assignment. A connected workspace runs nothing until a profile is assigned.
  2. Assignment disabled or profile disabled. Check both toggles.
  3. First scan has not run yet. Scans run at your tier's interval (Billing and tiers); a new assignment picks up on the next cycle.
  4. The workspaces are genuinely compliant. It happens.

Findings appear but actions never run​

  1. Policies are in Notify mode. Notify never acts; check the action mode per policy.
  2. A schedule is active. Schedules suppress Fix and Remove during their window (Schedules). A schedule covering all hours suppresses actions permanently.
  3. Cooldown. After an action, repeat actions on the same resource are suppressed for the cooldown period (organization settings).
  4. Action FAILED. Check the finding's action status; failures usually mean missing permissions in the workspace.

A finding will not resolve​

Findings auto-resolve after going undetected for consecutive scans (default 2). If it stays open, the policy is still detecting the issue: the fix did not take, or fixed a different resource than the one flagged.

A resource keeps getting flagged that should not be​

Add it to the policy's exception list in the profile editor, or suppress the individual finding. For choosing between them, see Suppress vs exception.

Notifications​

No notifications arriving​

  1. Channel test fails: the webhook URL is wrong or revoked. Re-create it (Slack and Teams notifications).
  2. Test passes but no real notifications: check the delivery modes. Digest sends once per scan cycle; immediate only fires at or above the severity threshold.
  3. Threshold too high: an immediate threshold of critical stays silent through a flood of high findings.

Too many notifications​

Lower the noise at the source rather than muting the channel: raise the immediate severity threshold, move routine categories to digest-only, and tune the policies generating volume findings.

Access​

A user cannot sign in​

  1. Confirm the sign-in method matches how the account was created (email vs Microsoft)
  2. Check the user is active in user management
  3. With enterprise SSO enforced, the user must exist in the identity provider and be in a synced group

Invitations expire and can be revoked. Check pending invites in user management and send a fresh one.

Still Stuck​

Contact support@kostavo.com with the organization name, the workspace involved, and a screenshot of the error.