Troubleshooting integration sync failures

Check the integration status first

Open Integrations from the sidebar. Every integration card has a status badge: Connected, Pending, Error, or Not connected. The card also shows the last sync time and, if the last sync failed, the error message.

• Connected. Credentials are saved and the connection works; syncs run on the schedule you picked.
• Pending. The connection is being saved or tested.
• Error. The connection test or last sync failed. The card shows the error.
• Not connected. No credentials are saved, or the integration was disconnected.

If the status is anything other than Connected, start there. If it is Connected but things still look wrong, keep reading.

Sync is slow or stuck

Most "stuck" syncs are not actually stuck. Sync time scales with data volume:

• Identity providers with 1,000+ users: up to 10 minutes
• Cloud accounts with many resources (AWS, GCP): up to 30 minutes for first sync, 5 minutes for incremental
• SIEM and log sources: up to 60 minutes for first sync of a large historical window
• Vulnerability scanners with large scope: up to 20 minutes

Give it time before reconnecting. If a sync is still running after more than 2x the expected window, it is likely actually stuck. Click Sync on the integration card to try again. If that does not work, disconnect and reconnect.

Sync failed with an auth error

Common causes, in order of likelihood:

1. 1
   Token or secret expired or revoked. Happens when the admin who created an API token is deactivated, or when a client secret reaches its expiry date (Microsoft app registration secrets expire). Create a new credential, preferably tied to a service account rather than a personal login, and re-enter it.
2. 2
   Permission change on the source side. If your admins recently tightened API permissions (common when enabling stricter admin policies), the credential may no longer have the read access the integration needs. Re-grant the permissions listed on the connect form.
3. 3
   IP-based restrictions. Some customers add IP allowlists that exclude our sync infrastructure. See outbound IP ranges for how to handle allowlisted sources.
4. 4
   Credentials rotated. API key rotated on the source side without updating in Radius360. Click Configure on the integration card and enter the new credential.
5. 5
   Role or permission revoked. The role used by the integration (IAM role for AWS, app registration for Entra, etc.) had its permissions reduced. Review the role's policy against what we document in the integration's connection guide.

Sync succeeds but no evidence appears

The integration is Connected and the sync completed, but the Evidence Vault is empty for that source. Usually one of these:

• Scope is wrong. For multi-tenant or multi-account sources, the credentials may belong to an empty tenant or account. Check which tenant or account the credentials were created in.
• Source data is genuinely missing. If you connected Microsoft 365 to a brand-new tenant with no users or configuration, there is nothing to collect. Populate the source system.
• Evidence is appearing but you are filtering it out. Check the Evidence Vault filter: if you have a time-range filter set to recent, older evidence may not show.

Evidence is stale or missing

Each successful sync writes a fresh evidence row for every control it checks and removes the row it replaces, so evidence from a healthy integration carries the date of its last sync. If you see evidence dated from days ago:

• Check the last sync time on the integration card. If recent syncs failed, the card shows the error; fix it and click Sync.
• Check the sync schedule. An integration set to Weekly or Manual only will naturally carry older evidence.
• An automated source with no new evidence for 14 days is treated as stale: its last rows stop counting toward control completion until it syncs again.

Duplicate risks from one integration

Radius360 deduplicates risks by source reference. If you see what looks like duplicates, it's usually not:

• Similar-looking risks with different source references (e.g., the same vulnerability appearing on two different assets) are distinct risks, not duplicates.
• Genuine duplicates (same source reference, two risk records) are a bug. Report with the source references so we can investigate.

When to reconnect vs disconnect

• Reconnect when the connection has broken but you want to keep the integration. Credentials stay, evidence history is preserved, sync resumes.
• Disconnect when you are retiring the integration permanently, or switching to a different source. See disconnecting an integration safely for what happens to collected evidence.

Getting help

If the steps above don't resolve the issue:

• Ask the GRC Assistant "why is my [integration name] sync failing?" for context-specific diagnostics.
• Email support@radius360.co with the integration name, the error message (copy it from the integration card), and the approximate time the last successful sync completed.