# Troubleshooting and getting help

This page collects the most common issues Axiad Mesh administrators run into —
sign-in and onboarding, connectors, and exports — along with how to check
service status and what to include when you contact Axiad.

## Sign-in and onboarding issues

### You see a "Things are getting set up" page after signing in

If you sign in and land on a **Things are getting set up** page instead of the
dashboard, nothing is wrong with your account. This page appears while your
organization's connectors are still being configured. Once connectors are
integrated and sharing data, the homepage displays your identity ecosystem
visualization instead.

![The Things are getting set up page, shown while connectors are still being configured](/img/imported/end-user-onboarding/things-getting-set-up.png)

If you're a standard user, check with your Mesh administrator on the state of
connector setup. If you're the administrator, see
[Connectors & Integrations](../connectors/index.md) to add your first
connector.

### Your onboarding welcome link has expired

The sign-in link in your Axiad welcome email is tied to a temporary account
and expires. If the link expires before you complete your initial
configuration, contact Axiad for a new one. For the full first-time setup
flow, see [Admin onboarding](../getting-started/admin-onboarding.md).

### Problems with the onboarding email verification code

Opening an onboarding link presents a verification screen before onboarding
starts. A 6-digit code is sent to the same email address the link was issued
to.

- The code expires after about 10 minutes. If it expires before you enter it,
  request a new code — you don't need a new onboarding link.
- After three failed code attempts, the link is invalidated. Contact Axiad
  support or request a new onboarding link.
- The link and code are consumed together once onboarding starts — neither can
  be reused.

### Your session expired mid-task

If your session expires while you're working, sign back in. After you
authenticate, you return to the page you were on — including asset list and
asset details pages — and can pick up where you left off.

### Your organization can't be resolved at sign-in

If your organization uses a dedicated sign-in URL (in the form
`{tenant}.mesh.axiad.io`) and Mesh can't resolve your organization during
sign-in, you see an explicit error page rather than a silent fallback to the
generic sign-in. If this happens, contact Axiad support — dedicated sign-in
URLs are configured by Axiad.

## Connector issues

### Start with connector health

Connector health is your primary diagnostic for data-collection problems:

- **Authentication failures** surface the specific error returned by the
  source system. For Microsoft Entra ID, this includes the error code from
  Microsoft when available.
- If **Entra ID authentication stalls** after setup, an explicit failure state
  appears in connector health within 30 seconds.
- **Workday sync failures** record the reason in connector health, so you can
  see why a Workday sync is stuck.

A connector is marked **Enabled** only after authentication actually succeeds,
so an Enabled connector has authenticated at least once. If a connector fails
its configuration test while you're setting it up, the error text tells you
what to fix.

### A connector stops collecting

The most common cause of a previously working connector that stops collecting
is an expired credential, such as a client secret or API token that reached
the end of its validity period in the source system. Check connector health
for the authentication error, then rotate the credential — see
[Manage connector credentials](./credential-management.md).

### Users deleted in Entra ID still appear in Mesh

Deletions in Microsoft Entra ID propagate to Axiad Mesh: after each
successful full synchronization, users no longer present in Entra ID are
marked **Terminated**, and risk findings for Terminated users are cleared
automatically. Two things to know about this safety net:

- It runs only after a complete, successful full synchronization — never after
  a partial or incremental one. If a deletion hasn't propagated yet, wait for
  the connector's next full synchronization.
- It only affects users from that specific connector. Users from other
  connectors are never touched.

If users deleted in Entra ID still appear as Active after your connector has
completed a full synchronization, contact Axiad support.

### On-premises collection through the edge agent

For systems collected through the Axiad edge agent, check the agent before the
connector:

1. In **Settings → On-prem agents**, check the agent's status. The
   [status table](../connectors/on-prem/set-up-on-prem-connector.md#step-4--wait-for-the-agent-to-come-online)
   explains what **Unenrolled**, **Enrolled**, **Stale**, and
   **Decommissioned** mean.
2. If the agent isn't healthy, work through the
   [edge agent troubleshooting table](../connectors/on-prem/run-the-edge-agent.md#troubleshooting)
   with your agent operator — it maps common symptoms (permission errors,
   expired enrollment tokens, blocked outbound connections) to fixes.

## Export issues

- **An export seems stuck or you can't start another one.** While an export is
  running, the **Export** button is disabled and notifications show that the
  export is in progress. When it completes, a notification confirms the number
  of records exported.
- **An export fails with a temporary error.** After a temporary service error,
  the export checks the actual job status instead of declaring failure. If an
  export is already running, its status is displayed. You can retry after a
  temporary error — you're never left without a way to retry.
- **You need to trace a failed export.** The audit log records both the start
  of every export and its final outcome, success or failure. The entries for
  one export share the same transaction ID, so you can trace it from start to
  finish. Each entry is attributed to the user who initiated the export, and
  exports triggered through the API also record the client IP address.

## Checking service status

The Axiad Mesh status page is at
[https://status.mesh.axiad.io/](https://status.mesh.axiad.io/).

- It's public and read-only — no sign-in is required.
- It ignores browser cookies entirely, so it loads reliably from any network,
  including corporate networks where cookies from other sites accumulate.
- From inside the product, select your name or avatar to open the user menu
  and select **Axiad Mesh Status**. The link opens in a new browser tab, so
  your current session is preserved.

For current availability and incident information, check the status page
directly.

## Contacting Axiad

- **New connector or identity provider requests.** If the connector you need
  isn't listed, contact
  [Axiad Customer Success](mailto:customer.success@axiad.com) to request it as
  an enhancement.
- **Account and tenant changes.** Contact Axiad support — through your Axiad
  account team or the support contact in your agreement — for:
  - A dedicated sign-in URL for your organization.
  - A replacement onboarding link, or help after a verification-code lockout.
  - Changing your organization's default dashboard (Human Identity or
    Non-Human Identity).

### What to include in a support request

The more precisely you can point at the problem, the faster it gets resolved.
Include:

- **Your tenant or organization name**, and your dedicated sign-in URL if you
  have one.
- **What you did and when.** Note that timestamps in CSV exports are always
  UTC, regardless of your tenant's timestamp display preference — say which
  time zone your times are in.
- **Transaction IDs** from the relevant audit-log entries, so Axiad can trace
  the exact operation.
- **The exact error text from connector health**, including any source-system
  error code (for example, a Microsoft error code from Entra ID).
