Each entry below is a problem as you would describe it, followed by why it happens and what to do. Most of them have a fuller explanation in the article for that part of Eido, which is linked at the end of the entry.
Two checks answer a surprising number of questions, so start with them:
- How fresh is the data? Open Admin, Intune Tenants and read the status under the tenant’s name. Eido reads each tenant about once an hour. See What Eido syncs.
- Which customer are you looking at? If you manage several customers, the list at the top of the sidebar decides whose data every screen shows. Choose All Customers to see everything you are allowed to.
Signing in#
Sign-in errors appear in red on the sign-in page, above Sign in with Microsoft. The full table is in Regions and signing in.
“This user account does not exist on Eido”#
Why. Microsoft signed you in, but there is no Eido user with your sign-in name in the region you are using. Having an account in your organisation’s Entra tenant is not enough on its own.
What to do.
- Check the region. Eido runs separately at
eu.eido.io,uk.eido.ioandus.eido.io, and your account exists in only one of them. See I do not know which region we use. - If the region is right, ask an Eido administrator in your organisation to add you on the Team page. The email address they enter must be exactly the name you sign in to Microsoft with. An alias will not match.
- If you signed up yourself and see this, the address you signed up with is probably not your Microsoft sign-in name. Raise a ticket with Eido support, giving both addresses.
I do not know which region we use#
Why. The three regions do not share accounts, so the wrong address refuses you even though your Microsoft sign-in worked.
What to do. Use the Login to Eido button in your welcome email, which opens the right region. Or add /select-region to any Eido address to open Select your region, and try each in turn. A colleague who already uses Eido can read the region from their browser’s address bar. See Regions.
“This account has been removed”#
Why. You had an Eido account and an administrator removed it.
What to do. Ask an Eido administrator in your organisation. Adding you again on Team with the same email address restores the account.
“Your access has been removed”, or “We could not read your group membership from Microsoft”#
Why. Your role comes from an Entra security group. Either you are no longer in a group that is linked to a role, or Microsoft did not send your groups with the sign-in.
What to do. For the first message, ask to be put back in the group. Your role returns at your next sign-in. For the second, try again. If it keeps happening, tell your Eido administrator, who should check Linking roles to Entra groups.
“Azure AD OAuth2 login failed”#
Why. The sign-in did not complete. Usually the Microsoft sign-in was cancelled or was not approved.
What to do. Try again and finish the Microsoft sign-in. If it still fails, raise a ticket with Eido support, giving the address you are signing in with and the time you tried.
The error is on a Microsoft page#
Why. A message on Microsoft’s own page, usually with a code beginning AADSTS, means your Entra tenant stopped the sign-in before it reached Eido. Conditional Access, or a rule that applications must be approved by an administrator, are the usual reasons.
What to do. Give the code to your Entra administrator. The reason is in your tenant’s Entra sign-in logs.
“Terms of Service & Data Processing Agreement” fills the screen#
Why. A new organisation cannot be used until an administrator has accepted the terms. If you are not an administrator, you see a message saying they have not yet been accepted, and the only button is Log Out.
What to do. Ask an administrator in your organisation to sign in and press Accept and Continue. It is needed once for the whole organisation. See Accept the terms.
“Your trial has expired” fills the screen#
Why. The free trial ran out before the organisation moved to a paid subscription. Syncing has stopped as well.
What to do. Raise a ticket with Eido support to extend the trial or to upgrade. Nothing has been deleted. See When the trial ends.
I keep being asked to sign in again#
Why. A session belongs to one browser and ends when the browser’s site data is cleared, when the browser changes (after an update, for example), when an administrator changes your role, or when the sign-in reaches its maximum age. A private window never remembers you.
What to do. Sign in again. Eido brings you back to the page you were on. See Staying signed in.
“Pop-up blocked” when I try to do something#
Why. Before an action that changes a device or your Intune tenant, Eido opens a small Microsoft sign-in window to confirm it is you. Your browser stopped that window.
What to do. Allow pop-ups for your Eido address, then press the action again. See When the confirmation does not work.
Connecting Intune#
The steps, and a table of what can go wrong, are in Connecting Intune.
Microsoft says I need admin approval#
Why. Linking a tenant asks Microsoft for admin consent, and the account you signed in to Microsoft with is not allowed to grant it. Eido’s own setup screen says access must be approved by a Global Administrator.
What to do. Do the linking step again with a Global Administrator signed in to Microsoft. That person does not need to keep the role afterwards for Eido to carry on working. See Who needs to do it.
I accepted, but no tenant was added#
Why. The consent has to be finished in the same browser that started it, within 15 minutes. Copying the Microsoft link to a colleague, switching browser part way, or leaving the consent page open for too long all end the same way.
What to do. Start again from Link New Tenant and finish in one go, in one browser. If somebody else holds the Microsoft role, either add them to Eido as an administrator so that they can link the tenant themselves, or start the link on your screen and have them sign in to Microsoft in that browser.
“Failed to start Intune authentication”#
Why. Eido could not prepare the Microsoft sign-in.
What to do. Try again. If it keeps happening, raise a ticket with Eido support.
Deploying a template or restoring a policy is not possible#
Why. Writing to Intune needs the tenant to be linked with Read-Write Access. Read-Only Access, and a tenant linked with your own app registration, cannot write. The access level is shown next to each tenant’s sync status on Admin, Intune Tenants.
What to do. Link the tenant again and choose Read-Write Access. Eido keeps the existing tenant and its data, and changes only the access level. See Change a tenant’s access level.
One part of Eido is empty for a tenant that otherwise works#
Why. Eido could not read that area. With your own app registration it usually means the permission for that area was not granted. On any tenant, Backup Policies or Sync Discovered Apps may be switched off in the tenant’s settings, which stops policy definitions or discovered apps being read.
What to do. Check the tenant’s features, and compare what your app registration grants with What Eido reads.
Data that is missing or out of date#
Everything is empty just after linking a tenant#
Why. The first sync reads the whole tenant and can take up to 30 minutes. Dashboards may be empty until it finishes.
What to do. Wait. On Admin, Intune Tenants, the tenant shows Pending sync, then Sync in progress, then a countdown to the next sync once the first has finished.
A tenant is not syncing, or its data looks stale#
Why. Read the status under the tenant’s name on Admin, Intune Tenants.
| Status | What it means | What to do |
|---|---|---|
| 42 mins until next sync | Healthy. The last sync finished within the hour. | Nothing. If one device looks stale, see the next entry. |
| Sync in progress | A sync is running. | Wait. If it has said this for many hours, open the tenant and use Sync Now with Force Full Sync on. |
| Pending sync or Pending completion | The first sync has not finished yet. | Wait up to 30 minutes. |
| Pending | The next sync is due and about to start. | Nothing. |
| Overdue by … | Syncs are not completing for this tenant. | Check the causes below, then email support. |
| Tenant paused | Syncing is switched off for the tenant. | See Tenant paused. |
Causes of a tenant that used to sync and has stopped, all of which you can check yourself:
- The Eido application was deleted or disabled in your Entra tenant. Look under Enterprise applications in the Microsoft Entra admin centre.
- A permission was removed from the Eido application.
- You use your own app registration and its client secret has expired. The date you recorded is under Secret Expiry in the tenant’s settings.
What to do. For the first two, link the tenant again from Link New Tenant with the same access level. Eido keeps the existing tenant and its data. For the third, create a new secret in Entra and enter it in the tenant’s settings. If none applies, raise a ticket with Eido support, giving the tenant’s name. See When a sync fails.
A tenant says “Tenant paused”#
Why. There is no pause switch for customers. A tenant is paused when the organisation’s free trial has expired. A demo tenant is always paused, because it has nothing to sync.
What to do. For an expired trial, see Plans and billing. Syncing resumes by itself once the trial is extended or you upgrade.
I changed something in Intune and Eido does not show it#
Why. Three clocks are involved. The device has to report to Intune. Intune has to include the change in the report Eido reads, which can take some hours. Then Eido has to sync, which it does about once an hour. Eido can never be more up to date than Intune is.
What to do. Check Intune Last Sync on the device: if that is older than your change, Intune does not know yet. To skip the wait for Eido’s own sync, open the tenant on Admin, Intune Tenants and press Sync Now. See Sync a tenant now.
A device is missing from Endpoints#
Why. Work down this list.
| Cause | How to tell |
|---|---|
| It was enrolled since the last sync | The tenant’s sync status shows when the next sync is due. A new device appears after it. |
| Device scoping leaves it out | Open the tenant on Admin, Intune Tenants and look at Device Scoping. A tenant can be limited by platform, by Windows device type (physical, Azure Virtual Desktop, Windows 365), by Entra user or device group, and can exclude ConfigMgr or Co-managed devices. With scoping on, a device with no primary user is left out unless Include orphaned devices when applying scoping rules is ticked, and is always left out of a tenant limited by User groups. |
| It is a kind of device Eido never brings in | Devices managed only by Microsoft Defender for Endpoint, and Microsoft Dev Box machines, are left out whether or not scoping is on. |
| It was deleted from Intune | It left Endpoints at the next sync. Its last known details are in the Deleted Devices view in Query Hub. |
| A customer is selected | The customer list at the top of the sidebar is showing one customer. Choose All Customers. |
| Your account or role does not cover it | An account limited to one customer sees only that customer’s devices, and a custom role can carry filters that are always applied. Ask an administrator to check your role. |
| It is in a tenant that is not linked | Only devices from the tenants on Admin, Intune Tenants are in Eido. |
What to do. If scoping is the cause, an administrator can widen the rule. The device returns at the next sync. See Device Scoping and Endpoints.
All our devices have disappeared#
Why. A device scoping rule that nothing matches removes every device at the next sync. The usual cause is a wrong group ID pasted into Group GUIDs.
What to do. Correct the rule in Device Scoping and save. The devices come back at the following sync.
A status shows Unknown#
Why. Unknown means Eido has nothing to grade, not that something is wrong.
| Where | Usual reason |
|---|---|
| Compliance | No compliance policy has reported for the device yet, or Intune itself reports the device’s compliance as unknown. A newly enrolled device often reads Unknown until Intune has evaluated it. |
| Compliance, Config and Apps on a device managed only by Configuration Manager | The device does not run Intune’s compliance, configuration or app workloads, so Intune has no results for it. Its Patch status is still real. A co-managed device has real results. |
| Patch | The device reports an operating system build that Eido does not have in its catalogue, or reports no version at all. |
| A device graded by Major OS Rules | The device’s model is not recognised. It reads Unknown until an administrator adds it to the tenant’s rules. |
What to do. For Configuration Manager devices, either accept the Unknown or leave those devices out of Eido with device scoping. If a released Windows build stays Unknown on Patch, tell Eido support the build number. See Endpoints.
A patch status looks wrong#
Why. Eido does not ask the device whether Windows Update is happy. It compares the operating system build the device reported to Intune with the patches Microsoft has released, and applies your organisation’s thresholds.
| What you see | Why |
|---|---|
| Overdue, but Windows Update on the device says it is up to date | A newer patch has been released than the one installed. Eido counts from the patch’s release date, plus the deferral on the device’s update ring. A gradual rollout can offer the patch to the device later than that. |
| Overdue, but the device was patched yesterday | Intune has not passed the new build on yet. Check Intune Last Sync on the device. A device that has been switched off keeps its old build in Eido while new patches go on being released. |
| Pending, though it is several patches behind | It is still inside the time your thresholds allow. |
| No Support, though fully patched | The operating system version is at, or within 30 days of, the end of vendor support. It needs a newer version, not a patch. |
| Outdated Major OS | The device is on a major version older than your organisation’s rules allow. |
| Red, but every patch reads installed | The colour is the whole Patch grade, which also covers operating system support and major OS rules. The label says which is responsible. |
| The grade did not change after an administrator changed a threshold | Grades are recalculated during a sync. Saving tenant settings starts one. Allow it to finish. |
What to do. Open the device and look at Patches to see each patch, its release date and its status, and the update ring Eido has matched the device to. The thresholds are under Patch Rules in the tenant’s settings. See Patch compliance, Device details and Patch Rules.
“You do not have access to this resource”, or a list that is always empty#
Why. Your role blocks that data view, or always applies a filter to it that matches nothing. When a view is blocked, the message may name it and say that your role may block the view.
What to do. Ask an administrator to check the role’s Permissions tab. See The Access Designer.
Things you expected to see#
Admin, or a tile in Admin, is missing#
Why. Admin is shown only to administrators. Within it, each tile is shown only to somebody who can open the page behind it.
- An administrator who is limited to one customer sees Team, Alerts and Wallboards only.
- With a customer selected at the top of the sidebar, the tiles that belong to the whole organisation are hidden: Customers, Computed Columns, Intune Tenants, Integrations, Eido AI and Odie Assistant.
- Eido AI appears only once Eido AI has been made available to your organisation.
What to do. Choose All Customers. If the tile is still missing, it is your role. See Which Admin pages each can open.
App Metering is not in the sidebar#
Why. App Metering is switched on for each Intune tenant separately. Either no tenant has it on, or none of the tenants you can see has it on.
What to do. An administrator switches it on in the tenant’s settings. See Setting up App Metering.
“The Regex rule … is not a valid regular expression”, or “A Regex rule … has no pattern”#
Why. A Regex rule on one of the applications you are saving is empty, or is not a regular expression Eido can use. One such rule used to stop the collector on every device, so Eido now refuses to save it.
What to do. The message names the application and the rule. Correct the rule, or change it to Process Name if you only need to match the program’s file name, and save again. Nothing was saved the first time. See Rule types.
App Metering shows no data#
Why. Switching it on is only the first step. Usage reaches Eido from the devices themselves, and several things have to be in place.
- At least one enabled application on the tenant’s list. Eido collects only the applications you name. With an empty list, devices report nothing.
- A collector on the devices. Either the two remediations, deployed in Intune and named exactly
Eido-SWM-CertificateandEido-SWM-Collector, or the Eido Client with App Metering switched on. - Process auditing switched on on the devices. Without it Windows records nothing for the collector to read.
- A sync since the certificate remediation ran, so that Eido recognises the devices.
- A day’s wait. Eido totals each day after it has ended (in UTC), so the first figures appear the day after devices start reporting. Nothing from before the collector was installed is brought in.
App Metering covers Windows devices only.
What to do. Work through the checklist in App Metering is on but the page is empty, which uses the diagnostics list to show which step each device has reached. Allow a day or two from assigning the remediations before deciding something is wrong.
Eido AI is not in the sidebar#
Why. Eido AI is made available by Eido on request. It cannot be switched on from inside the product. Until it has been, there is no Eido AI group in the sidebar and no Eido AI tile in Admin.
What to do. Ask us at Eido support. Once it is available, an instance-level administrator switches AI Diagnostics on. See Eido AI.
Odie is not on the page#
Why. One of two things. An administrator has not switched him on for your organisation, or you have hidden him yourself.
What to do. Open Settings (the gear at the bottom of the sidebar). If there is a row called Odie, the Eido assistant, switch it on. That choice is remembered by the browser, so a new browser or cleared site data resets it. If the row is not there, he is not switched on for the organisation: an instance-level administrator does that under Admin, Odie Assistant.
There is no Eido Client switch in a tenant’s settings#
Why. The Eido Client is made available by Eido on request.
What to do. Ask us at Eido support. See The Eido Client.
The Eido Client#
The fuller list is in The Eido Client.
A device has the client installed, but Eido Client Status is blank#
Why. The client has not been linked to a device in Eido. A client can only be linked to a device that Eido has already synced from Intune, and the link is made during a sync. Other causes are an install command that used an old token or the wrong Eido address, the Eido Client being switched off for the tenant, or a device that was enrolled before and has since been rebuilt.
What to do. Wait for the next sync, or start one with Sync Now. If the status is still blank, copy the install command again from Enrollment in the tenant’s settings and reinstall. For a rebuilt device, see Switch it off, or remove it.
A device shows Offline#
Why. The client checks in every five minutes. Offline means it has not checked in for more than 15 minutes. Usually the device is switched off, asleep or has no network.
What to do. If the device is in use and still Offline, check that it can reach your Eido address on port 443. See What devices need to reach.
A device is Online, but the tools or Device Metrics do not work#
Why. Live tools and Device Metrics use a second connection, separate from the one that reports Online. The Real-Time chip at the top of device details shows its state.
| Real-Time | What to do |
|---|---|
| Reconnecting or Pending | Wait a few minutes. |
| Blocked | Allow outbound TCP 443, and ideally 8883, to *.azure-devices.net. |
| TLS Inspected | Exempt *.azure-devices.net from TLS inspection. |
| Proxy Blocked | Let the connection out directly. It cannot go through a proxy. |
| DNS Blocked | Something is stopping the device looking up the address. Check DNS filtering. |
| Not Reported | The device has not reported its checks yet, or its client is too old to. It will once it updates. |
| Unavailable | The problem is on Eido’s side. Raise a ticket with Eido support. |
What to do. Press the chip to open Real-Time Channel, which lists each check and the addresses to hand to your network team. After a change, press Re-run checks and reopen the panel in about five minutes. See Is a device reporting?.
A tool or action is missing from the Tools tab#
Why. Each tool has its own switch per tenant, and actions that change a device are behind a separate Enable Write Actions switch. Those actions are only ever shown to administrators.
What to do. An instance-level administrator checks Tools under Eido Client in the tenant’s settings. See Tools.
Alerts and automations#
An alert did not arrive#
Why. An alert is sent when a new issue is raised that matches it, and again when that issue clears. Work down this list.
- Severity must match exactly. An alert for Unhealthy - Medium does not fire for a High issue, and the other way round. Create one alert for each severity you want.
- The kind of issue must be switched on. Under Alert On, each kind (compliance, configuration, managed apps, patching, certificates) has its own switch, and Alert Type must be the right family.
- The issue must be new. Issues that were already open when the alert was created do not trigger it.
- Scope. An alert created for one customer covers that customer only.
- The destination. Open the alert and press Send Example Alert. If the example does not arrive, the address, webhook or account is the problem, not the alert.
- Junk mail. For email, check the junk folder and any mail filtering.
Alerts are not sent the instant an issue appears. Issues are worked out at the end of a sync, and alerts go out a few minutes after that.
What to do. Fix whichever applies. There is no log of sent alerts to consult, so Send Example Alert is the test. See An issue was raised but no alert arrived.
An automation has never fired#
Why. The first check after an automation is created, edited or enabled fires nothing: it records what already matches, and only later changes trigger it. It is also checked only at the end of a tenant’s sync.
What to do. Open the automation and press Test Run to see what matches now, and look at its History for what was sent. See Automations.
Reports and exports#
An export failed#
Why. Export as CSV builds the file on Eido’s servers from every matching row, which on a very large view can take a few minutes. While it runs the table shows “Preparing your export. Large exports can take a few minutes.” If it cannot finish, you see Export failed. Please try again. or a general error.
What to do.
- Leave the page open and try once more.
- If the query filters on a version column with Greater Than or Equal or Less Than or Equal, remove that filter and export again. Those comparisons cannot be used in an export. Filter the version in the spreadsheet afterwards.
- Narrow the export with a filter, or show fewer columns.
- If it still fails, raise a ticket with Eido support, giving the name of the report or view and the time.
See Export to CSV.
An export has fewer rows or columns than I expected#
Why. An export is never cut short by a row limit, but it follows what the screen is showing.
| What is missing | Why |
|---|---|
| Columns | Only the columns you are showing are exported. |
| Detail rows | The table is grouped. A grouped export has one line per group. Clear Group By to export the rows behind the groups. |
| Rows | A filter, a search, the selected customer, or a filter your role always applies. |
| Rows in a scheduled report email | The emailed file holds up to 250,000 rows, and always the rows, not the groups. |
| Rows or columns in a workbook PDF | Tables in a PDF stop at 500 rows and 8 columns, and the PDF says so under the table. |
| A chart | Charts and tiles have no export. Switch the visualisation to Table. |
Dates and times in an export are in your browser’s time zone.
What to do. Show the columns you need, clear the grouping and check the filters before exporting. For more than the on-screen export suits, see Export Jobs.
A scheduled report did not arrive#
Why. Only table reports that are not shared can be scheduled, the schedule’s times are UTC, and a schedule stops if its owner’s account is removed.
What to do. Check the report still shows the Scheduled badge and has a recipient, then check the recipient’s junk folder. See Why did the scheduled email not arrive?.
An export job shows Failed#
Why. The row shows the error in red. Most often the storage connection string no longer works, no view is ticked, or the administrator who created the job no longer has an account.
What to do. Open the job and press Test Connection, correct what it reports, then press Try Again. See When a run fails.
The browser#
Eido has gone back to dark mode, or my colours have reset#
Why. Dark mode, colour-accessible mode and whether Odie is shown are remembered by the browser, not by your account. A new browser, another computer, a private window or cleared site data all start from the defaults, and Eido starts in dark mode.
What to do. Switch dark mode with the sun or moon button next to the gear at the bottom of the sidebar. Colour-accessible mode is in Settings, behind the gear. See Your settings.
“500 Error calling Eido platform”, or another error in the corner of the screen#
Why. Eido could not complete a request. A number followed by Error calling Eido platform. is a fault on Eido’s side or a request that did not get through. Access Denied means your role does not allow what you tried.
What to do. Reload the page and try again. If the same action fails twice, raise a ticket with Eido support, giving the page, what you pressed, the exact text and the time. See Contact support.
A page looks wrong, or will not load#
Why. Eido keeps your session and your preferences in the browser’s site data, and a browser extension can interfere with any web page. A private window sets both aside, which makes it a quick way to tell a browser problem from an Eido one.
What to do. Reload the page. Then try a private window, which rules out extensions and stored data. If it works there, clear the site data for your Eido address and sign in again. Remember that this signs you out and resets dark mode and your other browser preferences. If it fails in a private window too, tell us which browser and version you use.
Still stuck?#
Contact support. The more of the detail listed there you can send, the quicker the answer.