StrataDocs
↑↓ navigate ↵ open esc close

Troubleshooting and FAQ

The single page that answers "something is not working" and the most common questions.

If your issue is not here, write to support@kronisys.com.

Sign-in problems

"Continue with Microsoft" does nothing or stays spinning

Almost always a pop-up blocker. Strata opens Microsoft's sign-in flow in a pop-up window; if your browser blocks it, the flow ends before it starts.

  • Allow pop-ups for the Strata web app's domain.
  • Click Continue with Microsoft again.

After two minutes with no response, Strata gives up and restores the button so you can retry.

"Sign-in expired or invalid. Please try again."

The OAuth state cookie (10-minute lifetime) aged out before you finished the Microsoft flow, or the state did not match what Strata issued. Click Continue with Microsoft to restart.

"Too many sign-in attempts. Please wait a few minutes and try again."

Sign-in is rate-limited at 30 attempts per 15 minutes per IP. Wait the window out.

HTTP 503 "Authentication not configured"

The deployment is missing its Microsoft SSO configuration (Azure AD app ID, secret, tenant). This is an environment problem — contact your administrator.

Pop-up closed and you are still on the sign-in screen

Strata re-checks /api/auth/me when the tab regains focus and when the pop-up closes; in most cases that completes the sign-in silently. If you remain on the sign-in screen:

  • Check that cookies are enabled for the Strata domain (the session cookie must persist).
  • Try again; the second attempt almost always works.

Pop-up shows "Sign In Failed"

Microsoft rejected the sign-in. Common causes:

  • Your account is not in the tenant Strata is configured against.
  • Your account is in the tenant but has not yet been invited to Strata.
  • Conditional access, device compliance, or location policies block the sign-in.

The pop-up shows Microsoft's error message; include it in any support request.

"Signed out — Your session expired. Please sign in again"

Your 12-hour session aged out, or an admin revoked it from Admin -> Active Sessions. Sign in again.

Extension connection problems

SQL Server connection fails or times out

  • Confirm the host, port, database name, and credentials.
  • Confirm Strata's outbound IP is allowed by the database firewall — your DBA can provide the SQL Server's allow-list.
  • Some database servers require encryption settings (TLS); confirm with your DBA.
  • If you can connect to the same server from another tool but not from Strata, capture the exact error message and contact support.

"Access disabled — \<extension\> access was disabled by your administrator."

The toast appears when you call an extension's API and the server returns 403 with extensionDisabled. Your admin removed your role's or your user's access to that extension. Ask your admin to enable it in Admin -> Organization Settings or your role configuration.

OneDrive / Outlook consent prompt is rejected

You declined Microsoft's consent screen for the scopes Strata requires. Re-open Settings -> Extensions, click the extension's Connect action, and accept the requested scopes. Without consent, Strata cannot list, read, or modify files or emails on your behalf.

Jira and Confluence

Both reach Atlassian Cloud rather than your Microsoft 365 tenant, so their failures have their own vocabulary. They also share one connection but are two separately governed extensions, so an admin allowing one says nothing about the other. Atlassian extensions has the full picture; this is the triage list.

  • "Your organization has not set up Jira yet." — no Jira site is pinned for your organization. The site is an organization setting, so a member cannot pin it by connecting: an admin with Manage organization settings (canManageOrgSettings) has to set it under Settings -> Extensions -> Atlassian -> Manage (or be the first person to connect, which records an audit row) before anyone else can connect.
  • "This Jira site is not authorized for your organization." — the request reached a Jira site that is not the pinned one. Strata re-checks the pin on every request, so an Atlassian account that has since consented to more sites still cannot reach them through Strata. If the site is genuinely the right one, an admin has to change the pin.
  • "That issue is outside the projects your organization has allowed Strata to read (…)" — your org set a project allow-list and the issue belongs to a project that is not on it. The allow-list bounds searches, counts, single-issue reads, and Jira Service Management queues alike, so a direct key lookup does not slip past it. Ask an admin to add the project under Settings -> Extensions -> Atlassian -> Manage.
  • "Creating Jira issues is not enabled for this account." or "Commenting on Jira issues is not enabled for this account." — Jira writes do not resolve on for you (errorCode: jira_writes_disabled, action contact_admin). Three settings can cause it and the message does not say which: the org-wide Let Strata create issues and comment toggle under Settings -> Extensions -> Atlassian -> Manage, the Jira writes capability on your role, or the Jira writes override on your account under Admin -> Users. An admin has to check all three — see Who may write. While writes are not permitted the create and comment tools are never given to the AI at all, so it cannot work around it.
  • "Jira is disabled on this deployment." — the deployment-wide JIRA_ENABLED switch is off, which is a Kronisys setting rather than an organization one. Jira reads as not configured everywhere and no admin setting can override it. It takes Confluence down with it, since both ride one Atlassian OAuth app; the separate CONFLUENCE_ENABLED switch turns Confluence off on its own and leaves Jira live.
  • "…is a Jira Service Management request. Commenting there is disabled for your organization." — writes are on but the separate service-request comment toggle is off. Ask an admin before assuming it is a misconfiguration: a comment on a service request cannot be edited or deleted afterwards through Jira's API. When the toggle is on, Strata posts JSM comments only as internal notes, never visible to the customer who raised the request.
  • Jira went quiet for everyone after the service-account credential changed — in "one organization account" mode Strata re-mints its token from the stored client secret, so a rotated or revoked secret stops every member at once, reported only as a generic Jira failure. The stored secret is encrypted and never displayed, so an admin has to re-enter it in full under Settings -> Extensions -> Atlassian -> Manage; Strata verifies it against your site before saving, and a bad one comes back as "Jira rejected that service account. Check the credential and that its scopes include read:jira-work."
  • "…is in the <KEY> space, which is outside the spaces your organization has allowed Strata to read." — your org set a Confluence space allow-list and that space is not on it. Space keys are case-sensitive here, unlike Jira project keys, so eng will not match ENG. Ask an admin to add the space under Settings -> Extensions -> Atlassian -> Manage, in the Confluence group.
  • Strata will not create or edit a Confluence page — Confluence writes resolve through their own three layers (the org toggle Let Strata create and edit pages, the Confluence writes role capability, and the per-member override), independently of Jira's, so allowing Jira writes does not allow Confluence writes. Separately, Strata only ever creates pages and adds comments — despite the toggle's wording there is no tool that edits an existing page, so a request to change one cannot be satisfied at any permission level.
  • An agent or API key wrote to Jira or Confluence without showing an approval prompt — that is the design. In chat, every write is shown to you for approval first; a scheduled agent or an API key has nobody to ask, so its writes proceed. Restrict which agents may write through the write_jira and write_confluence capabilities, the role allow-lists, the per-member agent-extension controls under Admin -> Users, and — the narrowest lever — the owner's Jira writes and Confluence writes overrides on the same tab, which stop every agent that person owns from writing while leaving their reads intact. Review the jira.issue_created, jira.comment_added, confluence.page_created, and confluence.comment_added rows in the audit log. Everything Strata files carries a trailing line naming Strata, and for an agent, which agent and for whom.

Extension was working yesterday, not today

  • Your Microsoft Graph token expired and refresh failed. Reconnect from Settings -> Extensions.
  • Your admin disabled the extension org-wide. Check Settings -> Extensions — the card will say the extension is unavailable.
  • Your IT enforced new conditional access; the existing consent may be invalid.

Chat problems

The AI returns nothing or a blank message

The model produced only a tool call or a malformed block. Try:

  • Send a follow-up such as Please re-render the last response.
  • Switch to a different model in the model picker and retry.

Generation stalls or freezes

Click the stop button (the square icon in the send button's place while streaming) to abort, then send again. If it stalls every time on the same prompt, the prompt may be hitting an upstream timeout; try breaking it into smaller asks.

"Too many requests" (HTTP 429)

You hit your per-user chat or token rate limit. The error includes how long to wait. Limits cascade from environment default to org default to role default to per-user override; ask your admin to raise yours from the Profile & Access tab under Admin -> Users -> \<your user\> if you need more.

Model unavailable / model error

Strata draws its models from a central Model Catalog that Kronisys curates; your organization enables the subset it wants. A model can be missing from your picker, or fail mid-prompt, because:

  • Your admin disabled it for the org in the Model Catalog (Admin -> Organization Settings -> Models -> Open the catalog). Only enabled models appear in the picker.
  • Your role does not include it. The models you can use are the intersection of the org's enabled set, your role's allowed set, and any per-user override — so a model the org enabled can still be hidden by your role.
  • An admin restricted it for your user specifically (Admin -> Users -> your user -> AI models). Unchecking a model there narrows you below the org/role set.
  • Your organization runs its own Azure AI Foundry and the deployment for that model is missing or unhealthy in your Foundry. Strata only enables a model after its deployment verifies — see Foundry verification fails below.
  • Upstream provider outage. Switch to another model and try again.

"No active database connection"

The AI tried to run SQL but no SQL Server connection is active for you. Open Settings -> Extensions and connect or activate a database connection. If you previously had one connected and it has since gone away, see the SQL Server section above.

"Database connection lost. Please reconnect from the connection screen."

The connection pool for your active database died (server timeout, network blip, password change). Re-open Settings -> Extensions and reconnect the database.

Chart, Excel, or rich block did not render — you see raw JSON

Almost always the model emitted text after the block, or the response was cut off mid-block. Ask the AI to regenerate (Re-render the chart from the last response); if it keeps happening on the same prompt, switch to a different model.

Your response was cut short

If a response stops early and ends with a > [WARN] Response cut short callout, your organization reached its monthly spend ceiling mid-answer. When the ceiling is hit, Strata finishes the current thought and stops rather than continuing to spend. This is an organization-wide limit, not a per-user one — everyone's AI pauses at the same time. Ask an admin to review spend under Admin -> Usage and raise the ceiling under Admin -> Billing; once the new period begins or the ceiling is raised, chat resumes normally.

Agent problems

Agent did not run at its scheduled time

  • Confirm the agent is enabled on the Agents page.
  • Confirm its cron schedule resolves to your expected timezone (the next-run column shows what Strata computed).
  • If your org enforces a minimum cron interval, a schedule below it is rejected when you save — you'll see "Schedule is too frequent…" and the agent won't save until you widen the interval, so a too-frequent schedule never silently skips.
  • Your org may cap how many times an agent runs per day (max_agent_runs_per_day). Once an agent hits that cap, further scheduled runs are skipped silently until the next day. Raise the cap under Organization settings -> Defaults (Max agent runs per day) if agents need to run more often.
  • Check the agent's run history for errors; rate-limit or tool-failure errors will surface there.

Webhook trigger returns 401 "Invalid signature"

Your X-Webhook-Signature header does not match what Strata expects. Strata uses v2 webhook signing: the HMAC-SHA256 is computed over "<timestamp>.<raw_body>" — the X-Webhook-Timestamp value (unix seconds or milliseconds), a literal period, then the raw request body — using the agent's webhook secret.

  • Include X-Webhook-Timestamp on every request (unix seconds or milliseconds). Requests without this header are rejected outright for v2 secrets.
  • Sign "<timestamp>.<rawbody>" — the exact same timestamp string you send in the header, a period, then the raw bytes of the body. Do not re-serialize the body; many JSON libraries normalize whitespace or trim trailing newlines, which produces a signature that does not match the bytes Express receives.
  • Confirm you are using HMAC-SHA256 with the exact secret shown in the agent's webhook settings.
  • Timestamps older than 5 minutes are rejected (replay protection). Keep your client clock in sync.
  • If the secret was rotated, update your client; the old secret stops working immediately.

Notification email not received

  • Check your spam folder. Agent notifications come from a Kronisys-managed sender (not your mailbox), so your inbox may quarantine them.
  • Confirm the recipient address in the agent's notification settings.
  • Confirm your domain's SPF / DKIM / DMARC alignment if your mail policy is strict.
  • If the agent has errors-only notifications, no email is sent on successful runs by design.

Knowledge base problems

Chat never searches the knowledge base

  • Your organization may not have enabled it. Knowledge base search needs the OneDrive extension enabled org-wide and at least one indexed SharePoint source — ask an admin to check Admin -> Organization Settings -> Knowledge Base.
  • Your role may not include SharePoint. KB content is sourced from SharePoint, so a member whose role disallows SharePoint can't trigger a knowledge base search even when the org has sources indexed.
  • The AI decides when a search helps. Rephrase explicitly ("According to our documentation, ...") to nudge it.

A knowledge base source shows "error" (admin)

  • No Microsoft access — the org connection is not set up, or the admin who added the source disconnected OneDrive. Reconnect under Settings -> Extensions, or set up the organization connection on the Knowledge Base page.
  • Site not granted — the org app cannot read that SharePoint site yet. Click Grant access (requires SharePoint admin rights).
  • Embedding deployment unavailable — your embedding model is not responding in your organization's Foundry. Check Admin -> AI Engine.

See Knowledge base for the full admin workflow.

Admin / AI Engine problems

Everyone's AI stopped mid-response

Every member's chat is cutting off with a > [WARN] Response cut short callout, or new responses stop almost immediately. Your organization reached the monthly spend ceiling configured for its billing period. When the ceiling is hit, Strata stops AI work org-wide for the rest of the period rather than spending past the limit. Review current spend under Admin -> Usage; raise the ceiling under Admin -> Billing or wait for the next billing period to begin, and AI resumes for everyone.

Scheduled agents stopped running and nobody paused them

Every agent in the organization has quietly stopped. Their run history shows Paused — not started, and opening a run gives the reason: "Organization's subscription is inactive — agents are paused until billing is resolved". The subscription lapsed or was cancelled, and agents are held org-wide rather than run against an inactive account.

Runs are skipped, not failed, so the agents do not accumulate failures and do not hit the five-failure auto-disable. Restore the subscription at Admin → Billing and they resume on their normal schedules — nothing needs re-arming and no agent needs editing.

This is the one billing state with no on-screen error, because an agent that does not run has no session to show a notice in. If agents stop and the reason is not obvious, check the subscription before the schedules.

Members see "Subscription required" but admins can still work

Non-admin members get a Subscription required notice — "Your organization does not have an active Strata subscription. An admin can start one in Billing." — while administrators carry on normally. This is not a fault: it is what a lapsed or cancelled subscription looks like.

Administrators are deliberately never blocked, so whoever can fix the problem can always reach Admin → Billing to fix it. Start or restore the subscription there and members regain access without anyone signing out.

If the subscription is cancelled rather than lapsed, note that access ends when the period you have already paid for runs out, not on the day you cancel. During the 30 days after cancellation an administrator can still export the organization's data or request erasure from the admin pages — see Data retention.

Foundry verification fails during onboarding or in Org Settings

Strata calls your Azure AI Foundry to confirm reachability and that the deployments for the models you selected exist. Failure points:

  • Wrong endpoint. Use the resource's base URL — for example https://your-resource.services.ai.azure.com — not a per-model URL.
  • Bad API key. Generate a fresh key from your Azure portal.
  • Missing deployments. Strata only probes the deployments for the models you chose to enable — it does not require every catalog model. Each selected model maps to a specific Foundry deployment name (for example a model enabled as GPT-5.4 looks for the gpt-5.4 deployment; Claude Opus 4.8 looks for claude-opus-4-8), and that deployment name must match exactly. The exact name a model expects is shown next to it in the verification results. Note that Foundry's models.list returns catalog model names, not deployment names — Strata calls the deployments by name, so the name has to match.

All AI broke and there is no fallback

Strata runs inference only in your organization's Azure AI Foundry, so there is no fallback if that Foundry becomes unreachable. Fix the Foundry (deployment failed, key rotated, region down) and the AI comes back. To swap to a different Foundry, update the endpoint and key from Admin -> Organization Settings -> AI Engine and re-verify.

Org-wide settings not applying to a user

  • Your org may have left the setting unlocked, allowing per-user overrides. Lock the setting under Admin -> Organization Settings -> Locks for it to override every member.
  • Model access is not a lockable default. The org's enabled models are always authoritative — you cannot "lock" them. If a user still sees a model you disabled, confirm it is off in the Model Catalog and check their role's allowed models and any per-user override under Admin -> Users -> the user -> AI models.
  • The user may need to refresh; settings hydrate on sign-in and on /api/platform/settings calls.

Platform problems

"Reconnecting…" appears with "Your connection to Strata was interrupted"

The frontend's health check (which polls /api/health every 20 seconds while the tab is visible) failed. Strata keeps polling and restores the page automatically once the connection comes back.

If the message persists for more than a few minutes, contact support@kronisys.com.

503 "Strata is in maintenance mode. Please check back shortly."

The deployment's maintenance kill-switch is active (STRATA_MAINTENANCE=1 set in the environment). Wait for the maintenance window to end.

FAQ

Does Strata work without a database?

Yes — no extensions are needed to hold a conversation. Once your organization has connected its Azure AI Foundry (the one-time AI-engine setup done during onboarding), Strata works as a general-purpose AI assistant with no extensions connected — you can have conversations, draft text, build charts and exports from sample data, and use file upload to analyze content. Connecting an extension unlocks the live-data tools for that service.

Can chats be deleted?

You can remove a chat from your own view — open the ⋯ menu on a chat in the sidebar and choose Delete. The conversation disappears from your list but is retained in the database so admin exports still include it (Strata keeps history for activity tracking). Your organization's Auto-purge deleted chats setting controls when those rows are permanently hard-deleted. To avoid saving a conversation in the first place, use incognito chat, or an admin can disable Save AI conversations org-wide.

Who can see my data?

  • Conversations and AI output: only you, unless your admin enabled saving and an admin with the matching permission reviews them.
  • SQL results, file content, email bodies: depend on your org's Save extension output setting.
  • Audit log entries: any admin with canViewAudit.
  • Aggregate usage and spend: any admin with access to Admin -> Usage.
  • Across organizations: never. Tenants are fully isolated.

How is billing calculated?

Token usage (input + output) and tool calls roll up at Admin -> Usage. Models are priced per million tokens at their published rates; cached prefix tokens are discounted. Inference is billed by Microsoft directly against your organization's own Azure subscription — it never appears on a Kronisys invoice. Kronisys bills separately for the platform: seat fees, compute credits for finished work (a flat $0.50 per credit — today one finished deliverable is one credit, whatever its size). Searching and reading (inbox search, file reads, database lookups) never draw credits.

How long do inbox messages stay?

Unread messages never expire — they stay in your Inbox until you open or dismiss them. After you read a message it moves to the archive at /inbox/all rather than disappearing: agent-run notifications stay there (they no longer self-delete; you can remove them yourself), the welcome message stays until you dismiss or delete it, and announcements follow your organization's message-retention policy. Read messages older than 90 days move to cold storage, reachable via See past messages in the archive. See Inbox for the full retention policy.

Can an admin un-send an announcement?

Yes. From Admin -> Announcements, open the announcement and click Recall — it is removed from every recipient's inbox immediately and permanently. There is no scheduled send; announcements deliver the moment you click Send. See Announcements.

Where is the in-app help assistant?

Open the account menu at the bottom of the left sidebar (your name and avatar) and click Support. The panel slides in from the bottom-right corner and stays open as you move around the app. It answers product questions instantly, lists quick-answer FAQs, and links to email support for billing and account requests. See Getting help in Strata.

How do I get support?

Related