Troubleshooting

This page collects the issues administrators hit most often. For end-user symptoms, see the teacher-facing Troubleshooting page.

I see the Configuration area, but saving fails with “must be an administrator”

The Configuration UI and the save authorization are validated against two different Entra enterprise applications. If your Administrator role is assigned only on the MovoSuite (sign-in) app, the UI appears but every save is rejected with a 403.

• Assign the Administrator role on both enterprise applications — MovoSuite and MovoSuite Server-Side — then sign out and back in. See Admin access.
• An Admin Group is honored on save as well as in the UI. The one exception is a user who belongs to more than 200 groups — Microsoft Entra then omits group membership from the token, so assign that user the Administrator app role instead.
• Global Administrators are always recognized, which is why the issue may not affect the person who originally set MovoSuite up.

Teachers can see all apps and devices

If you haven’t configured RBAC, this is expected — without it, teachers can view all apps and all devices. Enable RBAC along with Self-Service Tags and Groups under General & RBAC to scope what each user sees by location.

A teacher can’t see a device

• Confirm the device is enrolled in Intune and has been picked up by the Device List Update cycle (every 30 minutes — see Scheduled actions).
• Confirm the device is assigned to a location the user has access to (Devices).
• A device that was wiped and re-enrolled comes back without its previous group memberships — re-add it. See the device lifecycle in Devices.

A request is stuck “in progress”

• Open the Requests area, click info to inspect it, and click the circular-arrow to reprocess it.
• If it’s waiting on approval, the request pauses until the approver acts — check whether an approval email (or Teams card) is sitting unactioned.
• Deployment and purchase assignments are processed by storage-queue triggers as work arrives; if nothing is moving at all, check the Functions backend and Application Insights.

Notifications aren’t being delivered

• The sender must be a User or Shared Mailbox — not an Office 365 Group mailbox (Prerequisites).
• Verify the recipient addresses on the Notifications tab.
• For Actionable (live) emails: recipients must use a current version of Outlook, and the recipient should be an Office 365 Group — shared/resource mailboxes fall back to plain HTML.

Actionable emails don’t update / Provider ID issues

• The Office 365 Provider ID must be created and approved by an Exchange or Global Administrator, then saved back into MovoSuite (Notifications).
• The sender address registered with the Provider ID must match MovoSuite’s configured sender address.

Deployments suddenly stopped working

Check for expired Apple tokens or certificates — an expired APNS certificate, DEP token, or VPP token will halt enrollment and deployment. MovoSuite warns 30/14/7 days ahead; see Alerts & monitoring. Also check whether an app key or password credential behind MovoSuite’s integrations has expired.

Devices aren’t being renamed

• Renaming runs hourly (Device Rename cycle). A device is only renamed if it doesn’t already match the defined format.
• Confirm a naming convention is defined for the relevant DEP/AutoPilot profile and that the device is assigned to a location if the convention uses the location variable (Integrations & bulk admin).

Still stuck?

MovoSuite emits structured telemetry to Application Insights with the release version stamped on each event. That’s the first place to look for backend errors.