Troubleshooting
The most common messages, with the fix. Always start at https://<your-domain>/api/ready: it tells you at once whether it's the database, Microsoft, the server gateway or the license. The app itself may show messages in Dutch; their meaning is given here.
Sign-in
| Message | Cause | Fix |
|---|---|---|
| Microsoft didn't send an email address | Optional claim or email field missing | Fill in the email field of the user in Entra; turn on the optional claims email and xms_edov on Rollout – Login; try in a private window |
| Microsoft sign-in is still off | Provider in Supabase is off | Supabase → Authentication → Providers → Azure on |
AADSTS50105 not assigned | Assignment required, but not for this account | Entra → Enterprise applications → Rollout – Login → Users and groups |
AADSTS50020 doesn't belong to this organization | Account from another tenant | Sign in with your own organization's work account |
AADSTS7000215 invalid client secret | Wrong or expired secret | New client secret in Entra; paste the value (not the ID) into Supabase |
AADSTS50011 redirect URI mismatch | Redirect URI of Rollout – Login | https://<project-ref>.supabase.co/auth/v1/callback |
| Back on the sign-in page after signing in | Redirect URL missing in Supabase | Supabase → URL Configuration → https://<domain>/auth/callback (step 6) |
Your message isn't listed? Look in Supabase → Logs → Auth for the exact error.
Server gateway
/api/ready shows | What to do |
|---|---|
"gateway": "missing-secret" | ROLLOUT_GATEWAY_SECRET is missing or shorter than 32 characters. Set it and redeploy |
"gateway": "not-enforced" | Secret is there, but the hash isn't in the database yet. Run the update line from the script |
"gateway": "mismatch" | Secret and hash don't belong together: booking links do not work. Run node scripts/gateway-secret.mjs again and set both values. Quick fix: update platform_settings set gateway_secret_hash = null; |
| Deze functie is alleen via Rollout bereikbaar | That's good: a direct call is refused ("this function is only reachable via Rollout") |
Client tenants
| Message | Fix |
|---|---|
| Tenant … staat niet in GRAPH_ALLOWED_TENANTS (not in the allowlist) | Add the tenant ID to GRAPH_ALLOWED_TENANTS and redeploy |
| Deze tenant hoort niet bij een klant van jouw organisatie (not a client of your organization) | An administrator links the tenant ID to the client (Project → Connection) |
| Connection test fails on excessive permissions | The app registration got a write permission. Remove it in Entra and have the client grant consent again |
Federation doesn't work (AADSTS70021, no matching federated identity) | Copy Issuer, Subject and Audience exactly, case-sensitive; Audience is https://vercel.com/<team>, not the default |
| Checks show grey ("unknown") | Microsoft isn't reachable or the client has no Entra ID P1 (for sign-in data). Check the Microsoft 365 status page |
Configuration
| Message | Fix |
|---|---|
| In livemodus is een client secret niet toegestaan (no client secret in live mode) | Use GRAPH_FEDERATION=vercel (or a certificate), not GRAPH_CLIENT_SECRET |
| GRAPH_ALLOWED_TENANTS is leeg (empty) | Always required: set at least one tenant ID |
| APP_URL moet een https-adres zijn (must be https) | https://rollout.yourmsp.com, without a path and without a trailing slash |
A change to a NEXT_PUBLIC_ variable does nothing | Those are baked in at build time: redeploy |
| "Renew license" explanation screen | License missing, invalid or expired more than 30 days ago. See License |
Still stuck?
Email sales@rollout365.com with what you did, what you saw (a screenshot helps) and the output of /api/ready. Never send secrets, passwords or the service_role key.