Troubleshooting Common Issues
Core concepts
Troubleshooting follows a layered method: identity (sign-in, 2SV, SSO), authorization (roles, sharing, groups), service status (OU inheritance), and delivery (mail flow, routing, spam). Common issues include users unable to sign in, mail not delivered, Drive sharing blocked, calendar invites missing, and groups not receiving mail. Tools include the Email Log Search, audit logs, message header analysis, the sign-in challenge report, and the user's own security and access reports. SSO issues often trace to IdP attribute mapping or clock skew. Mail issues often trace to routing rules, quarantines, or recipient address mismatches.
Traps
Questions may describe a symptom that looks like a bug but is a policy inheritance issue - always walk the OU tree. Another trap is assuming a message was blocked when it was quarantined or routed. Group delivery depends on membership and posting permissions, and external senders may be restricted. SSO failures can be caused by a stale session or a misconfigured attribute. Time-based issues (clock skew) break SAML assertions. Don't reset a password before checking 2SV and login challenges.
Rule of thumb
Reproduce, isolate the layer, then check the narrowest setting. For a worked example, a user reports missing mail from a partner: run Email Log Search for the sender and recipient, check whether the message was quarantined, routed, or rejected, then inspect routing and spam settings for that OU before changing anything.
Worked check
If sign-in fails only for SSO users, check IdP attributes and clock skew before touching Workspace password settings.