Understanding Errors

Errors in Tello IAM fall into two categories: configuration errors that the Administrator can resolve directly, and platform errors that require support. This article covers the most common error types, what causes them, and how to resolve them. If an error is not listed here or cannot be resolved using the steps below, contact Tello IAM support at support@seasoftsecurity.com.

Errors surface in 3 places in the platform: the Dashboard (anomalies and failed operations), the Users page (User records with a status of Issue), and Change History (failed operations with error detail).

Integration errors

Integration errors occur when Tello IAM cannot connect to or sync with a connected application. They typically appear on the Integrations page and may cause provisioning operations to fail for all Users in the affected application.

Authorization expired

The connection between Tello IAM and the integration has lost authorization. This commonly occurs when the account used to authorize the connection has its permissions changed or is removed from the connected application.

Resolution: Navigate to Integrations, select the affected integration, select Configure, and complete the authorization flow again using a valid administrator account for that application.

Invalid credentials

The API key or credentials provided for the integration are no longer valid. This occurs when an API key is revoked, regenerated, or expired in the source application.

Resolution: Generate a new API key or credentials in the source application and update them in Tello IAM via the integration's Configure panel.

Sync failed

The integration attempted to sync but did not complete successfully. This may be due to a temporary connectivity issue with the source application or a rate limit imposed by the application's API.

Resolution: Select Sync Now to retry the sync. If the error persists across multiple sync attempts, check the source application's status and confirm that Tello IAM's connection has not been restricted.

Provisioning errors

Provisioning errors occur when Tello IAM attempts to grant or remove access for a User in a connected application and the operation does not complete. These appear as failed entries in Change History and may also surface on the User record.

User not found in application

Tello IAM attempted to provision access for a User in a connected application, but the User does not have an account in that application. A Role Template cannot grant access in an application where the User does not exist.

Resolution: Confirm whether the User should have an account in the application. If so, create the account in the source application first, trigger a sync, and then retrigger the provisioning operation. If the User does not need access in that application, update the Role Template to remove that integration for this User's function.

Insufficient privileges

Tello IAM does not have the permissions required to make the requested change in the connected application. This typically means the account used to authorize the integration does not hold the necessary administrative role in the source application.

Resolution: Review the permissions held by the account used to authorize the integration. Reauthorize using an account with sufficient privileges, or grant the required permissions to the existing account in the source application.

License limit reached

The connected application has reached its licensed User limit. Tello IAM cannot provision the User because no additional licenses are available.

Resolution: Review available licenses in the source application. Remove access for Users who no longer need it to free up a license, or expand the license count in the source application before retriggering the operation.

Permission not available

The permission level configured in the Role Template does not exist or is not available in the connected application. This can occur if a permission tier was renamed or removed in the source application after the template was built.

Resolution: Navigate to Role Templates, select the affected template, and update the permission configuration for the relevant integration to a valid permission level. Save the template and retrigger the operation.

User record errors

User record errors appear as a status of Issue on the Users page. They indicate a problem with the User's data that prevents Tello IAM from managing their record correctly.

Missing required attributes

The User's record is missing a required attribute — most commonly an email address. Tello IAM requires a valid email address to identify and manage each User across integrations.

Resolution: Update the missing attribute in the source IDP or HR system, then trigger a manual sync from the Integrations page. The User record updates once the sync completes.

Duplicate user detected

Tello IAM has identified two records that appear to represent the same person — for example, a User who exists in both the IDP and an application under different email addresses. Tello IAM cannot reconcile these automatically.

Resolution: Review the User records identified as duplicates. Resolve the discrepancy in the source systems — align the email addresses or remove the duplicate account — and trigger a sync to allow Tello IAM to re-evaluate the records.

When to contact support

The following situations indicate a platform-level issue that cannot be resolved through configuration changes and should be reported to support:

• An error persists after following the resolution steps above
• Operations fail consistently for a specific integration with no clear configuration cause
• User records display unexpected behavior not explained by a known error type
• Data imported from an integration appears incorrect or incomplete after a successful sync
• The platform displays an error message not covered in this article

When contacting support, include the following to help diagnose the issue quickly:

• The affected User or integration name
• The error message or status displayed in the platform
• The timestamp of the failed operation (available in Change History)
• The steps already taken to resolve the issue

Contact Tello IAM support at support@seasoftsecurity.com.

Related articles

• Monitoring: Change History — review failed operation details
• Monitoring: Drift Detection — understand and resolve drift anomalies
• Managing Users — resolve issues on User records
• Configuring Integrations — reauthorize and manage integration connections