Syncs for this directory fail one after another. The dashboard shows the directory in error, and the organization's owners and admins receive the sync-failure alert email.
Why this happens
RingSync queries Microsoft Graph with an application permission
(client_credentials): access belongs to the application, not to whoever
granted consent. There is no user token to refresh and no inactivity expiry.
Three possible causes, depending on how the directory was connected.
Shared mode — consent was withdrawn. An Entra administrator removed the RingSync enterprise application, revoked its admin consent, or stripped its permissions. A conditional access policy can also block the application.
Dedicated mode — the client secret expired. Entra application secrets are time-limited, typically 6 to 24 months. Past that date the token exchange fails.
Either mode — assignment changed. RingSync only ever sees people assigned to the enterprise application. If the assignment was removed, syncs do not empty out — they simply find nobody.
How to fix it
Shared mode
Everything is resolved on the Entra side; nothing to do inside RingSync:
- In the Microsoft Entra admin center, open Enterprise applications and look for RingSync.
- Confirm the application still exists and is not disabled.
- Under Permissions, grant admin consent again if
User.Read.All,GroupMember.Read.AllandApplication.Read.Allare no longer listed. - Under Users and groups, confirm the relevant people are still assigned.
The next sync resumes on its own — no action is needed in RingSync, since access is not tied to any user account.
Dedicated mode
Generate a new secret in the Azure portal (App registrations → Certificates & secrets), then:
In RingSync, open Settings → Replace client secret, paste the new value and submit. The secret is checked against Microsoft before it is stored: if it is rejected, the previous one stays in place. The connection, the seats and the sync history are kept.
The Azure portal shows a secret's value once, right after you create it. Leave that screen and it cannot be retrieved — you have to generate another one. Take care not to copy the secret's ID instead of its value.
Preventing it
Record your secret's expiry date. In dedicated mode the Azure portal shows it under App registrations → Certificates & secrets. RingSync shows that date in the directory settings and emails the organisation's owners and admins 30 days ahead.
Re-check access after a policy change. Adding a conditional access policy, running an access review, or tidying up enterprise applications are the most common triggers. After any of those, run a sync from the mobile app to confirm access still holds.