| Symptom | First check | Escalation |
|---|---|---|
| “RBAC: access denied” before Microsoft sign-in | Note the exact address, time and current network; a changing public IP can affect an installation's ingress allowlist | Platform/network operator checks the actual rule and approved access route; do not widen rules speculatively |
| ?Your session has ended? | Save work before leaving in future; select Continue with Microsoft to sign in again. Unsaved edits from the ended session are not restored | If expiry occurs while actively working, report the time, browser, network interruption and whether multiple application addresses were open |
| Microsoft sign-in rejects the account | Confirm the intended tenant/account and capture the Microsoft error/correlation details | Identity administrator checks admission, guest identity and sign-in policy |
| Sign-in succeeds but a module/action is denied | Confirm organisation, active account, role, scope and current record state | Organisation administrator uses Access review and group sync evidence |
| A colleague sees a record that you cannot | Clear filters and check the reference, then compare intended responsibility scope | Administrator reviews authorised access; do not exchange credentials |
| Wrong organisation or unexpected private information | Stop entering data and preserve minimal safe evidence | Escalate immediately through the organisation's security process |
An Azure subscription role does not by itself grant avowr access. A changed IP rule does not replace Microsoft sign-in or application permissions.