Skip to content

Menu AuthGuardHelp centre

Search helpCtrlKKeyboard shortcut: / or Ctrl K

Videos Error codes

PTENPortuguêsauthguard.pt

Filter articles

Home
Video tutorials
Error codes and messages

End users40

Overview

Access recovery3

Generate and store recovery codes
Recover access by email ("I forgot my access details")
Sign in with a recovery code

Account2

Change your password
Confirm your email address

Approval requests1

Decide approval requests from your organization's systems

Federation1

Sign in to one of your organization's applications (single sign-on)

Linux sign-in1

Sign in to a Linux computer or server with phone approval

One-time codes3

HOTP and OCRA tokens (counter and challenge)
Set up an authenticator app (TOTP)
Sign in with a password and a one-time code

Passkeys2

Create a passkey
Review and remove passkeys

Phone approval9

Install the approver app on your phone
Link your phone to your account
Approve a request on your phone (comparison code)
I lost my phone or it was stolen
Get requests on your phone (notifications)
I got a request I did not make ("It wasn't me")
Remove an account from the approver app
Replace your phone
Sign in with your phone only, without a password

Privacy and GDPR1

My data: download it and confirm an email change

Privileged access (PAM)7

Approve privileged access requests
Connect to a database through privileged access
My SSH keys for privileged access
Open a remote desktop through privileged access
Request break-glass (emergency) access
Request privileged access (My access)
Use the web terminal and SSH command of a privileged access

Sessions1

Signed-in browsers and signing out

Signing in3

How to sign in to your organization's authentication service
Sign in with a passkey
Sign in with a password and a second factor

VPN and Wi-Fi (RADIUS)1

Connect to your organization's VPN or Wi-Fi

Windows sign-in5

I cannot use my phone on Windows (recovery with support)
Sign in to Windows offline (offline codes)
Sign in to Windows with phone approval
Unlock Windows, remote desktop and administrator prompts
Use your authenticator-app code on Windows

Administrators76

Overview

First steps3

Administrator first steps (checklist)
Activate your organization with the activation code
Self-hosted installation: create the first organization with the bootstrap token

Access policies6

Access policies: how they work
Access schedules in policies (UTC)
Create and activate a policy revision
Network zones (company networks in policies)
Simulate a policy before activating it (candidate and test decision)
The rule that allows application sign-ins (federation.authorize)

Approval requests1

Third-party requests: operation types and machine clients

Audit2

Audit: query events and create a JSON copy
Signed receipts and stored evidence

Branding1

Organization branding (colours, logos, texts)

Computer compliance1

Device posture (Windows computer compliance)

Console1

How the administration console is organized

Directory1

Directory connector (Active Directory and LDAP)

Domains1

Your organization's custom domains (administrator view)

Edge appliance4

Edge appliance configuration and modules
Edge appliance health (heartbeat, clock, certificates)
Enrol and confirm an Edge appliance
Install the Edge appliance (Docker or systemd)

Email1

Organization email: sender and email recovery

Helpdesk2

Dual approval of authenticator resets
Reset a person's authenticators (helpdesk)

Licences1

Your organization's licence and end-of-licence warnings

Linux sign-in1

Linux sign-in with a second factor: the PAM module and the agent

Microsoft 3653

Federate a Microsoft 365 domain (WS-Federation)
Microsoft 365 anchors (ImmutableID and UPN)
Microsoft Entra external authentication method

OpenID Connect2

OIDC service secrets (issue, rotate and revoke)
Register an OpenID Connect (OIDC) service

Organization1

Organization profile (name, identifier and slug)

People and groups4

Create people in the console
Change a person's role or suspend them
Groups (teams used in policies)
Roles, delegation and organization hierarchy

Phone approval1

Remove a person's approver phone

Privacy and GDPR2

Answer GDPR requests (access, rectification, erasure)
Retention of suspended accounts (automatic deletion)

Privileged access (PAM)14

Privileged access (PAM): overview and where to start
Application secrets for applications and CI pipelines
Dual control in privileged access
PAM break-glass: group, alerts and review
PAM settings (retention and per-connection approval)
Privileged access profiles (approvals, duration and permissions)
Privileged credential rotation
Privileged sessions and recordings (watch, terminate, replay)
Recorded database sessions (PostgreSQL)
Recorded remote desktop (RDP) sessions
Recording retention and legal hold
Targets and privileged accounts
The vault and privileged account credentials
Vault key escrow (a key kept offline)

SAML2

Register a SAML application
Renew the SAML signing certificate

SCIM and directory4

SCIM provisioning with Microsoft Entra ID, step by step
SCIM provisioning with Okta, step by step
SCIM tokens (create, rotate and revoke)
What SCIM does to accounts and groups

Security settings2

Organization security settings
Confirmation of administrative changes (passkey or phone)

Sessions1

Organization sessions (view and revoke)

Single sign-on1

Single sign-on: duration, inactivity and sensitive applications

VPN and Wi-Fi (RADIUS)3

Configure the RADIUS device (ports, timeouts and accounting)
RADIUS second-factor modes (code, phone or both)
Register a RADIUS client (VPN, firewall, Wi-Fi)

Windows sign-in10

Approve, disable and retire computers, and see their history
Computer policy: offline, break-glass and Safe Mode
Deploy the Windows agent with Microsoft Intune
Give the Windows recovery response to someone who cannot use their phone
Install the Windows agent silently and through Group Policy (GPO)
Install tokens for Windows computers
Map Windows accounts to people (SID)
The Windows break-glass account and what to do when nobody can sign in
Windows agent updates by ring
Windows sign-in with a second factor: overview

Distributors and partners18

Overview

Audit1

The distributor audit

Branding3

White label and your organizations' default branding (every field)
How branding inheritance works
What a distributor's customers see

Distributor7

The AuthGuard distributor portal
Create a customer organization (with a licence)
Issue a customer organization's activation code
Activate the distributor account and add operators
Suspend, resume, delete and restore customer organizations
The distributor's organization quota
Transfer an organization between distributors

Domains1

Customer and portal custom domains (DNS proof)

Email1

Per-brand email sender (SES and DKIM)

Licences3

Licence pools and seats
A customer's licence states and what happens at the end
Allocate, amend, renew and revoke customer licences

Platform1

Install AuthGuard on a customer's Kubernetes cluster (Helm)

Privacy and GDPR1

Data residency, retention and sub-processors (for contracts and procurement)

Developers18

Overview

API5

The AuthGuard API for integrators: overview and conventions
API authentication (machine clients, SCIM tokens, OIDC clients)
/v1/meta: features served and organization state
API errors and request limits
The OpenAPI contract

Approval requests4

Create an approval request (intents API)
Decision webhooks (Standard Webhooks)
Read a request's decision and cancel it
Verify a decision's signed receipt

OpenID Connect1

Integrate an application with OpenID Connect

Privileged access (PAM)1

The authguard-secrets command-line tool (CI and applications)

SAML1

Integrate a SAML 2.0 service provider

SDKs6

AuthGuard SDKs (TypeScript, Python, Java, .NET, Go)
.NET SDK
Go SDK
Java SDK
Python SDK
TypeScript / Node.js SDK

Troubleshooting58

Overview

First steps1

«Create the administrator passkey first to continue.» (passkey_enrolment_required)

Access policies1

«The authorization was already used, expired, or was denied by the active policy.» (authorization_rejected)

Access recovery1

«Complete the recovery: add a passkey…» (recovery_session_restricted)

Domains1

The custom domain does not get verified (DNS TXT record)

Edge appliance2

Edge appliance warnings and errors (modules, audit, configuration)
The Edge appliance has a stale or stuck enrolment

Email1

Invalid email link or an email that never arrives (email_link_invalid)

Licences2

Limit reached (entitlement_exceeded, entitlement_required, plan_not_allowed)
Organization read-only or without an active licence (license_read_only, license_inactive)

Linux sign-in1

Linux sign-in problems (approval, offline and service messages)

Microsoft 3651

Microsoft 365 sign-in errors (anchor, policy, import)

OpenID Connect1

OIDC application sign-in errors (invalid_client, invalid_grant, redirect_uri)

Organization4

«Activation is not finished.» (realm_activation_pending)
«This organization awaits activation.» (realm_provisioning)
«This organization is scheduled for deletion.» (realm_pending_deletion)
«This organization is suspended.» (realm_suspended)

Passkeys1

«Confirm the recovery password to remove the last passkey.» (recovery_required)

People and groups1

«The organization must keep at least one active administrator.» (last_active_admin)

Phone12

Requests do not reach my phone (notifications)
I cannot link my phone (linking errors)
«Phone approvals are paused for this account…» (device_approvals_suspended)
«Phone approvals are turned off for your organization.» (device_approvals_disabled)
«The approval key is no longer valid.» (phone)
«There are already requests waiting for this account.» (device_sign_in_pending_limit)
«This account already has the maximum of three phones.» (device_limit)
«This account has no phone that can approve.» (no_device)
«This application requires a passkey sign-in.» (phone approval not accepted)
«This phone is no longer linked to this account.» (device_revoked)
«This phone is not supported.» (Android 14 and hardware keys)
«This request could not be verified.» and other request warnings on the phone

Platform6

«Not found» (not_found, 404)
«The operation was not allowed by the active policy or by your permissions.» (forbidden)
«This record already exists.» or «Someone else changed…» (conflict, 409)
«Too many attempts.» and error 429 (rate_limited)
Invalid request (validation_error, invalid_request, invalid_cursor)
Service unavailable, not responding or slow (503)

Privileged access (PAM)1

Privileged access errors (pam_policy_denied, step_up_required, AGM01–AGM03)

SAML1

SAML application sign-in errors (invalid request, certificate, keys)

SCIM and directory1

SCIM answers 401 or 403 (token expired, revoked or missing a scope)

Security settings3

«Another administrator must approve this change.» (second_administrator_required)
The console asks you to confirm your identity again (recent confirmation expired)
Your organization requires phone approval for administrative changes

Sessions1

«Your session expired.» or «Your session ended.» (unauthorized)

Signing in6

My passkey does not appear or does not work
«Could not verify the identity.» (invalid_credentials)
«This operation requires a passkey with local verification.» (strong_authentication_required)
«This sign-in step was already used.» (continuation_consumed)
A second factor is asked for after the password (second_factor_required)
Clock out of sync (device_clock_skew, one-time codes refused)

VPN and Wi-Fi (RADIUS)2

The VPN or Wi-Fi refuses sign-in (RADIUS Access-Reject or no answer)
RadSec certificate problems (TLS)

Windows6

The Windows agent update failed or is paused
The Windows computer does not enrol (AGW01, AGW02, AGW04, AGW05)
Windows: «Sign-in is not allowed right now. Contact IT support.»
Windows: «Sign-in was not approved»
Windows: «The code is not correct. Try again.» and pending requests (AGW06, AGW08)
Windows: the service on this computer is not responding

Errors1

Error code index

FAQ12

Overview

Privacy and GDPR2

How is GDPR handled (my personal data)?
Where is the data?

Privileged access (PAM)1

What do privileged session recordings contain, and who can see them?

Security4

What will support never ask me for?
How is my account protected?
Is my fingerprint or face sent anywhere?
Is the service ready for post-quantum cryptography?

Signing in1

Which sign-in method is safest against phishing?

General4

What is not supported yet?
What are the Standard and Sovereign profiles?
What happens if the service is unavailable?
Which languages is the service available in?

No article matches the filter.

Help centre

Search

Search articles, messages or error codes/

AuthGuard

Authentication and approval, with proof.

Articles are checked against the product's code before every publication. Support never asks you for passwords, codes or tokens.

No tracking cookies and no analytics. The language and theme you choose stay in this browser.