Troubleshooting · 15.5
RBAC, Entra ID and break-the-glass
Access errors are logged in the Audit channel. Members of the local group Administrators on the management host can always sign in as break-the-glass Owner while that setting is on.
| Symptom | Cause | Solution |
|---|---|---|
| Desktop Admin console: Access Denied. You are not assigned to a management role. | RBAC is on, and your account has no role. | Ask an Owner to assign you a role in the RBAC Manager, or sign in as a local administrator (break-the-glass), see chapters Assign roles and Break-the-glass accounts. |
| Access denied for <user> on <action> (certificate <id>) | Your role does not allow this action for this certificate. | Ask an Owner for the required role or for access to the certificate. |
| Keep at least one System Owner. or At least one System Owner is required when RBAC is enabled. | RBAC is on, break-the-glass for local Administrators is off, and no System Owner would remain. | Assign another Owner first, or keep break-the-glass for local Administrators. |
| Restore can change every tenant on this host. You need the system role Owner on all tenants. | Restore needs Owner with Tenants: All. | Ask a host Owner to assign you Owner on all tenants or to run the restore. |
| This credential is already used by certificates whose admins would lose the right to use it. | The new allow list of the credential would lock out users of certificates that use it. | Add those users or groups to the allow list, or switch back to inherit system roles. |
| The tab RBAC in a certificate or credential is greyed out. | RBAC is not switched on. | Set up and switch on RBAC in the settings on the tab RBAC, then open the dialog again, see chapter RBAC. |
| Entra test: Entra rejected this client certificate (AADSTS700027). or The certificate is on this host but not on the Entra app. | The certificate is not listed under Certificates & secrets of the app registration. | Run the Entra ID helper again, see chapter Entra ID helper. Waiting does not attach the certificate. |
| … was not found in LocalMachine\… Check Settings → RBAC: the app registration credential points at a thumbprint that does not exist on this host. | The credential of the app registration refers to a certificate that is not on the management host. | Select the current certificate of the app registration in the settings on the tab RBAC. |
| The TLSPilot service runs as LocalSystem. Grant it access in certlm.msc → the certificate → All Tasks → Manage Private Keys → add SYSTEM (Read), then test again. | The service cannot use the private key of the certificate. | Grant SYSTEM read access to the private key as described. |
| … uses an ECDSA key. Entra client assertions require an RSA key - issue the app registration certificate with RSA. | Entra ID accepts only RSA keys for client assertions. | Issue the certificate of the app registration with an RSA key. |
| Web UI sign-in is not possible until RBAC is enabled. Turn RBAC on later in Settings → RBAC. | Sign-in to the WebUI requires RBAC. | Set up RBAC in the settings on the tab RBAC. |