RingSync lost access to the directory

An IT admin can find out why RingSync no longer reads the Microsoft Entra ID or Google Workspace directory, then restore access.

What you see

• On the directory's Dashboard, the Directory connection card shows Down and the message "RingSync has not been able to read your directory since …". It shows Needs attention when the client secret is about to expire or when access has not been refreshed for more than two hours.
• Under that message, the card gives the cause and the provider's raw error.
• The To fix table lists the people whose latest sync failed.
• Owners and admins receive an alert email (see Email alerts and timing).
• On a phone, the directory card switches to Error. Sync shows Sync failed.

What happens to contacts already on the phones

Nothing is removed. A failing sync neither writes nor deletes any contact, and a failing read of the seats does not remove any seat. Contacts stay on the phones as they were.

Until access is restored, directory changes no longer reach the phones. RingSync also cannot detect an access being removed: the contacts of someone who lost access stay on their phone until RingSync can read the directory again. See Microsoft permissions and Google permissions.

Find the cause

Open the directory's Dashboard. The Directory connection card shows one of these messages:

The client secret has one extra case: once it has expired, the card can also show "The client secret expired on …: syncs are failing." with the Replace the secret button.

To know how your Microsoft directory was connected: if the Replace the client secret card exists in Settings, it was connected with Manual entry. Otherwise, it was connected with Sign in to Microsoft.

Expired client secret (Manual entry)

What you see: the card shows "The client secret of your Entra application expired or is no longer valid", or "The client secret expired on …". Before expiry, it shows "The client secret expires in … days, on …" with Needs attention.

Cause: Entra secrets expire. RingSync can no longer sign in with the old one.

Fix:

1. In the Azure portal (portal.azure.com), open your app registration, then Certificates & secrets → New client secret, and copy the Value.
2. Copy its Value right away: the portal does not show it again.
3. In RingSync, open Settings, Replace the client secret card.
4. Paste the value into New client secret.
5. Click Replace.
6. Wait for the message "Secret replaced. The next syncs will use it."
7. Open Users and click Sync from directory to read the seats again right away.

The secret is checked with Microsoft before it is saved. If it is refused, the message "Microsoft refused this secret. Check that you copied all of it, and that it belongs to this application." appears and the old one stays in place. The connection, seats and history are kept.

The Replace the secret button on the dashboard card opens that same Settings page.

Withdrawn consent (Microsoft)

What you see: "RingSync’s access was removed from the Microsoft tenant (consent revoked or application deleted). If that was not intended, contact us."

Cause: admin consent was withdrawn, or the RingSync enterprise application was deleted from your tenant.

Fix:

1. In Entra, look for the RingSync enterprise application. With Sign in to Microsoft, it is called "RingSync Graph Access".
2. If it exists, open the page listing its permissions and check that User.Read.All, GroupMember.Read.All and Application.Read.All are granted with admin consent.
3. If the application was deleted, or if consent cannot be restored, write to us through Contact us.

The dashboard has no reconnect button.

Missing permission (Microsoft)

What you see: "A permission is missing: check User.Read.All, GroupMember.Read.All and Application.Read.All, with admin consent."

Cause: at least one of the three permissions is no longer granted with admin consent.

Fix:

1. In Entra, open the RingSync enterprise application.
2. Open the page listing its permissions and find the one that is missing.
3. Grant it again with admin consent.
4. With Manual entry, also check API permissions in your app registration.

The three permissions are described in Microsoft permissions.

Google access removed

What you see: "RingSync’s access to Google Workspace was removed: check the service account’s domain-wide delegation."

Cause: domain-wide delegation was removed or narrowed, the service account key was deleted, the admin account whose identity is used is no longer an admin, or OAuth access was revoked.

Fix with Service Account (DWD):

1. Open admin.google.com with an administrator account.
2. Open Security → API controls → Domain-wide delegation.
3. Check that the service account's numeric Client ID is present, with exactly the three read-only scopes.
4. Check that the account entered in Admin email to impersonate is active and still an admin.
5. In the Google Cloud console, check that the Admin SDK API is enabled and that the service account key still exists.

Scopes and full steps are in Google Workspace and Google permissions.

With Sign in with Google: the directory is read with the account shown as Delegated admin in Settings. If that account loses its admin rights, is suspended or deleted, or removes the access granted to RingSync, reading stops. The dashboard cannot reconnect a Google directory: write to us through Contact us.

The dashboard cannot replace the key of an already connected Google directory either. Contact us before any key rotation.

Unrecognized error

What you see: "The directory answers with an error (details below)." followed by the provider's raw error.

Cause: the error matches none of the causes above. It can be temporary, on the Microsoft or Google side.

Fix:

1. Wait for the next read of the seats: it runs every 15 minutes, and the card goes back to Working as soon as it succeeds.
2. If the error lasts, write to us through Contact us with the directory name and the raw error text.

On the phone

When the last sync of a directory failed, its card shows Error. Tapping the card opens the Sync paused screen, titled Token expired, with a Reconnect button. This screen appears for any error of the last sync, whatever the cause.

Reconnect signs the app out and reopens the sign-in screen. It does not restore RingSync's access to the directory: only the admin action above does.

Email alerts and timing

Owners and admins of the organization receive these emails, written in their language, with the cause and the provider's raw error:

These checks run daily: the email can arrive up to a day after the outage starts. Each alert is armed again as soon as a read or a sync succeeds.

Each owner or admin can turn these alerts off in Preferences, on their profile, with Receive operational alerts. Billing, suspension and account security emails are always sent.

If only one person is affected

If only one person no longer receives the directory, the cause is not RingSync losing access. Their access was probably removed in the directory: unassigned from the RingSync enterprise application for Microsoft, or taken out of the Authorized seats for Google. Their phone then removes the contacts of that directory, at the latest the next time the app is opened. See Seats and limits.

Still stuck?

Write to us through Contact us with the directory name, the message of the Directory connection card and the raw error shown under it.