Connection issues are one of the most common causes of sync failures. This article covers how to diagnose and resolve problems with your Microsoft 365 and Google Workspace connections.
Identifying a connection issue
Signs that a connection issue is causing problems:
- All users under a policy show a Failed sync status
- The connection status on the Connections page shows an error
- The audit logs show repeated authentication or permission errors
Microsoft 365 connection issues
The Microsoft 365 source connection uses certificate-based authentication. Common issues and resolutions:
| Issue | Cause | Resolution |
|---|---|---|
| Certificate expired | The PFX certificate uploaded to CloudM Continuity has passed its expiry date. | Generate a new certificate, upload it to Azure AD, then update the PFX file and password in CloudM Continuity via the three-dot menu > Edit on the Source Connection. See Rotating Microsoft 365 Credentials. |
| Wrong PFX file uploaded | The PFX file does not match the certificate registered on the Azure AD app registration. | Verify which certificate is configured on your app registration in Azure AD, then upload the correct PFX file via the three-dot menu > Edit. |
| Certificate not uploaded to Azure AD | The public certificate (.cer) was not added to the app registration's Certificates & secrets section in Azure AD. | In Azure AD, go to your app registration > Certificates & secrets > Certificates tab, and upload the public certificate that corresponds to the PFX file. |
| Insufficient permissions | Required Graph API permissions were removed or admin consent was revoked. | In Azure AD, verify your app registration has the required Application permissions with admin consent granted. |
| Incorrect Tenant ID or Client ID | The Tenant ID or Client ID entered in CloudM Continuity does not match the Azure AD app registration. | Use the three-dot menu > Edit on the Source Connection and verify the values match your Azure AD app registration. Test the connection after updating. |
| App registration deleted | The Azure AD app registration used by CloudM Continuity has been removed. | Create a new app registration following the Connecting Microsoft 365 guide, then update the Source Connection in CloudM Continuity. |
Track certificate expiry proactively
PFX certificates have an expiry date set when they are created. Note the expiry date and rotate the certificate before it expires to avoid unplanned sync failures. See Rotating Microsoft 365 Credentials for details.
Google Workspace connection issues
The Google Workspace destination connection uses token-based authentication. The CloudM token provider generates access tokens on behalf of your service account — no JSON key files are involved. Common issues and resolutions:
| Issue | Cause | Resolution |
|---|---|---|
| Token Creator role not granted | The CloudM token provider (coop-tp-sa@coop-production-488013.iam.gserviceaccount.com) does not have the Service Account Token Creator role on your service account. |
In GCP, go to your service account's Permissions tab and grant the Token Creator role to the CloudM token provider. See Connecting Google Workspace. |
| Wrong service account email | The service account email entered in CloudM Continuity does not match a valid service account in your GCP project. | Use the three-dot menu > Edit on the Destination Connection and correct the service account email. Test the connection after updating. |
| Domain-wide delegation scopes wrong or missing | The service account's domain-wide delegation was revoked or configured with incorrect OAuth scopes. | In the Google Admin console, go to Security > API controls > Domain wide delegation. Verify the service account's Client ID is listed with the required OAuth scopes. |
| API not enabled | The Gmail API or Admin SDK API was disabled in the GCP project. | In the GCP Console, go to APIs & Services > Library. Search for the missing API and click Enable. |
| Service account deleted | The service account used by CloudM Continuity has been removed from the GCP project. | Create a new service account following the Connecting Google Workspace guide, then update the Destination Connection in CloudM Continuity. |
Testing a connection after fixing an issue
After resolving a connection issue:
- Go to Connections in the sidebar
- Click the three-dot menu on the affected connection
- Select Test connection
- Confirm that a green toast notification — "Connection test successful" — appears
- Syncs will resume automatically on the next scheduled cycle
Preventing connection issues
| Best practice | Why |
|---|---|
| Track certificate expiry dates (M365) | Rotate certificates before they expire to avoid unplanned sync failures |
| Rotate service accounts periodically (Google) | Regular rotation limits exposure if a service account is compromised |
| Monitor the audit log | Connection test results and authentication errors appear in the audit log, giving early warning of credential issues |
| Limit who can modify app registrations and service accounts | Prevents accidental changes to permissions or credentials used by CloudM Continuity |
Need more help?
If you've followed the troubleshooting steps above and the connection still fails, contact support with the error message and the steps you've already taken.