Start with the failing action, exact new revision or named job execution. Keep the time, environment/VPN/queue, search or job ID and correlation ID. Use Container Apps system logs for image/scheduling/secret resolution failures and console/Log Analytics logs for application errors. Do not include passwords, API tokens, recovery codes or unapproved payloads in support records.
Sign-in, access and licensing
| Symptom | Action |
|---|---|
| No account/sign-in method | Confirm the email and enabled methods with the administrator. There is no public registration or first-administrator form. |
| MFA required | Complete sign-in with an enrolled method or saved recovery code; an authorized administrator can assist if all methods are lost. |
| Passkey fails on a new hostname | Check WebAuthn origin/RP ID and use another permitted factor. |
| Repeated login/MFA throttling | Stop repeated attempts, wait for the fixed window and confirm proxy/source-IP handling. An authorized, stepped-up administrator can use the user login-throttle reset API for a targeted recovery; do not disable global protections. |
| Session expired after upgrade/access change | Sign in again. Check Jobs before retrying an uncertain submission. |
| SSO rejected | Verify allowed provider ID, stable issuer/subject, email claims, HTTPS callback and signature requirements in Single Sign-On. |
| License remediation | An administrator with license:manage must upload a valid license for this installation; follow Licensing. |
| Missing Queue explorer/Message search | Select an environment and VPN; navigation also depends on permission. |
| Empty list or denied action | Check current scope, filters, roles, queue/target policy, enabled/read-only state and license capacity. Human queue roles supply queue policies; service/topic policies have a separate provisioning limitation. See access setup. Personal tokens do not inherit SSO-mapped grants. |
CONTENT_FILTER_REQUIRES_CONTENT_READ | Use metadata-only search fields or obtain appropriate content access for this queue. Do not assume browse permission grants content filters. |
Initial bootstrap cannot recover an initialized installation. Maintain at least two accountable administrators and saved recovery methods. If every administrator is locked out, contact support and the deployment owner for an audited, reviewed recovery action. v1.7.1 provides no general administrator recovery CLI; do not clear initialization markers or restore unrelated production data merely to reopen bootstrap.
Searches and jobs
| Symptom or code | Action |
|---|---|
| Search accepted but never runs | Preserve the search ID; check Worker readiness, matching queue name, database/queue schema and worker logs. Repeated submissions add backlog. |
| No search matches | Check scope and predicates; search is bounded and messages can be consumed. It does not prove absence beyond the scan/buffer limits. |
MESSAGE_REF_EXPIRED (410 on new operations) | Run a new bounded search and review a fresh selection. Use criteria for distant/recurring schedules. |
MESSAGE_IDENTIFIER_MISSING / MESSAGE_IDENTITY_AMBIGUOUS | Search again for a broker-identified message. Application IDs alone may be missing or duplicated; do not force a weaker match. |
AUTHORIZATION_REVOKED | Have the access owner review current permissions; queued work reloads authority before broker access. |
CRITERIA_NO_MATCHES | Review criteria/scope and current queue content before resubmission. |
JOB_STATUS_CONFLICT (409) | Refresh job state; another execution or cancellation changed it. Terminal states cannot be overwritten. |
| Failed/partial/cancelled job | Read item report, events and error. Reconcile source and target before retrying; cancellation does not undo prior work. |
| Publish confirmation timeout/session loss | Outcome may be indeterminate. Broker/operator teams must check whether the target accepted the message before retrying. |
delete_failed_after_publish item | A copy was published but source removal failed. Reconcile both sides; repeating the move can publish another copy. |
| One-time schedule has no job | It may have been consumed before creation failed or the Worker crashed. Review execution history and create a new schedule only after resolving the cause. |
| Scheduled access denied | Check the current execution owner; edits/enables transfer ownership and current grants are rechecked. |
Deployment and operations
| Symptom | Check and recover |
|---|---|
| Web binds port 80 and fails permission checks | Use the matching Web image and target port 8080. Do not make it root. |
node executable not found | Use /nodejs/bin/node and the compiled operator entrypoint. API/Worker have no shell/pnpm. |
| Migration connection retries | Check the named job’s privileged secret reference/identity, database password, private DNS/5432 route and CA. More retries do not fix networking. |
| Managed identity cannot read secret | Confirm identity assignment, secret-scoped RBAC, private endpoint/DNS, versionless URI and enabled secret version. Start a fresh execution after correction. |
Missing platform_settings or observability_destinations | Stop activation; confirm intended database/release and a successful migrator. Runtime does not install schema. |
| Unknown migration version / readiness 503 | Compare image and database identity; verify exact ledger, queue schema, configured queues and runtime access. Never edit the ledger or drop data as a workaround. |
| ACR 403/image pull failure | Check AcrPull, registry/private data DNS and network paths. Keep ACR admin credentials disabled. |
| Web 502, redirect loop or HTML for API | Verify bare API ingress FQDN, internal HTTP allowed, Web 8080/API target 3000 and proxy headers. |
| Missing key/decryption error | Restore the correct ordered key list to every consumer; restart. Do not generate replacement keys over existing encrypted data without a recovery plan. |
| API healthy but job fails | Check Worker and broker paths/permissions separately; readiness does not test Solace business operations. |
| Metrics missing | Check receiver paths/header/export policy and activity; follow Monitoring and Logging. |
| Broker connection edit rejected | Re-enter the matching password when changing host/port/scheme or messaging trust; see Manage Environments. |
For credential mismatch after rotation and restore procedures, use Security and Secret Rotation and Upgrade and Recovery. Capture actual verification results; do not treat a successful control-plane update as a completed application recovery.