This article explains the error messages and failure statuses you may see as a CanIPhish administrator, what each one means and how to fix it. To find a message, search this page (Ctrl+F, or Cmd+F on a Mac) for a few words of the text you see. Many messages appear as a notification with a short title in bold, such as Employee List Deletion. Each entry below gives that title too.
Contents
- Employee lists and imports
- Domain verification
- Directory integration and sync
- Creating and testing campaigns
- Phishing and voice delivery statuses
- Training assignment statuses
- Items you can't delete while a campaign uses them
- Platform users and signing in
- Scheduled reports and notifications
- Messages that ask you to contact support
- Related articles
Employee lists and imports
Error - Target currently in-use.
Where: On the Employees page, after you choose Delete list from a list's actions menu (notification title: Employee List Deletion).
What it means: At least one campaign on your Campaigns page still uses this employee list. A list can't be deleted while a campaign uses it, even a campaign that has finished delivering, until that campaign is archived.
How to fix it:
- On the Campaigns page, find the campaigns that use the list. To see which lists a campaign uses, choose Update campaign from its actions menu and look at the Name & audience step, then close the wizard without saving.
- Choose Archive campaign from the actions menu of each campaign that uses the list. A phishing campaign that hasn't sent anything shows Delete campaign instead. Archived campaigns keep their results on the Reporting page.
- Delete the list again.
Tip: Archiving stops a campaign and can't be undone. When you archive a campaign that assigns training, the confirmation has (Optional) Remove incomplete training assignments. ticked; clear it if employees should still complete that training. If employees who fall for a simulation should still be enrolled in remedial training, wait until the test has finished before you archive it. Campaigns run by the AI Program Manager can't be archived from the actions menu; make changes through the AI Program Manager - Introduction instead.
[email address] belongs to an unverified domain. Please verify "[domain]" to enable mail delivery.
Where: In the New employee list or Update employee list dialog when you add, import or sync employees (notification title: Unverified Domain).
What it means: The employee is still added to the list, but CanIPhish doesn't send simulations or assign training to addresses on a domain your tenant hasn't verified. Their results will show Failure - Domain Not Verified or Error - Domain not verified.
How to fix it: Verify the domain. On the Employees page, click Verification, then Verify a new domain. See Employees - Domain Verification.
CSV import messages
These appear when you upload a CSV file in the employee list dialog (notification title: Bulk Import, unless shown otherwise). See Employees - Import using a CSV file for the template.
| Message | What it means and how to fix it |
|---|---|
| No file specified. Please select a .csv file of employees to import. | Choose a file before you upload. |
| Error - Please ensure the file is comma delimited. The file appears to be delimited with another character such as semi-colons or tabs. | The file contains no commas. Save it as a comma-delimited CSV file and upload it again. |
| Error - Please ensure all column headers are left within the CSV file. The first row should start with FirstName, LastName, EmailAddress, Company, and JobTitle. | The first row is always treated as the column headers and skipped, and the first row under it has fewer than five columns. The dialog's employee table is emptied before this check, so close the dialog without saving to keep the list as it was. Keep the template's header row and all five columns in this order, leaving a column empty rather than deleting it, then upload the file again. |
| Error Importing Employee - Invalid Email | At least one row has an invalid address in the EmailAddress column. Those rows were skipped and the rest were imported. Add the skipped employees with Add employee, or correct the file and upload the whole file again. Upload file replaces the employees in the table with the ones in the file, so a file that contains only the corrected rows would remove everyone else when you save. |
| Check these names: Some text in this file looks damaged. This occurs when the file was saved with a different text encoding. | Correct the listed values in the table before you save, or in Excel save the file as CSV UTF-8 (Comma delimited) and upload it again. |
Domain verification
These appear in the Verification dialog on the Employees page (notification title: Domain Verification). The code is emailed from CanIPhish Verification (verify@caniphish.com) with the subject "Domain Verification Request For: [domain]". White-labelled tenants send it from their own name and domain.
| Message | What it means and how to fix it |
|---|---|
| Email Delivery Failed - Domain verification of free email services is not supported e.g. gmail, hotmail, etc. | Free email domains can't be verified. Use an address on your organization's own domain. |
| Domain Locked - This domain has been locked and cannot be verified on this tenant. | Another CanIPhish tenant has verified and locked this domain, so no other tenant can verify it. Locks are permanent and can't be removed from the platform, so if your organization owns the domain, contact the CanIPhish support team. |
| Code Verification Failed - [n]/10 Attempts Used | The code didn't match. Enter the code from the most recent verification email exactly as shown (capital letters and numbers; the dash is optional). Each time you click Send code, a new code is created and older codes stop working. You have 10 attempts; if you've used them all, contact the CanIPhish support team. |
| Email Delivery Failed - Domain Already Verified | The domain is already verified in your tenant. There's nothing to do. |
| Email Delivery Failed - Try Again Code Verification Failed - Try Again |
The request didn't go through. Try again, and contact support if it keeps happening. |
Directory integration and sync
These messages appear on the Employees page after you connect a directory under Directory Integration (title: Directory Integration), when an employee list loads its directory groups (titles: Directory Loading Error and Group Lookup), and when you click Sync directory employees (title: Sync Failure).
Microsoft Entra ID connection messages
Connecting Microsoft Entra ID has two steps: you sign in and accept, then an administrator grants admin consent. If Microsoft returns an error, you'll see one of these messages. The codes in the middle column are the Microsoft errors behind them.
| Message | Microsoft error | How to fix it |
|---|---|---|
| Microsoft consent was not granted (Step 1/2). Sign in with a Global Administrator and select Accept. | AADSTS65004 (consent declined) or access_denied | The permissions screen was closed, or Cancel was selected. Start again from Directory Integration, sign in with a Global Administrator account and select Accept. |
| Microsoft admin consent was not granted (Step 2/2). Sign in with a Global Administrator and select Accept to finish the integration. | AADSTS65004 or access_denied | Step 1 worked, but the admin consent screen was cancelled. Connect the directory again and, on the admin consent screen, sign in as a Global Administrator and select Accept. Or grant consent by hand with steps 5 to 10 of Azure AD Employee Directory Synchronisation. |
| The Microsoft account used cannot grant consent for your organization (Step 1/2). Sign in with a Global Administrator and select Accept. (The same message can say Step 2/2.) |
AADSTS90094, AADSTS90095, AADSTS65001, consent_required or interaction_required | The account you signed in with isn't allowed to approve apps for your organization; for example, it saw an "Approval required" screen. Sign in with a Global Administrator, or ask one to grant admin consent. |
| Microsoft sign-in is temporarily unavailable (Step 1/2). Please try again in a few minutes. | temporarily_unavailable or server_error | Microsoft had a temporary problem. Try again in a few minutes. |
| Microsoft sign-in did not complete (Step 1/2). Please try again with a Global Administrator account. If this persists, please contact the support team. | Any other error | Try again with a Global Administrator account. Contact support if it keeps happening. |
| Please ensure the admin consent was provided | None | Microsoft didn't return the details CanIPhish needs after the admin consent step. Grant admin consent again, or by hand as described in the setup guide. |
Note: Directory sync and Microsoft 365 Direct Email Injection use separate apps in Microsoft Entra ID, so admin consent for one doesn't cover the other.
Google account already authorised against a directory. Please contact the support team for assistance.
Where: On the Employees page after you connect Google Workspace (title: Directory Integration).
What it means: The Google account you signed in with has approved CanIPhish before, so Google skipped the step that gives CanIPhish the long-term access it needs. This comes from Google, not from an old directory in CanIPhish, and you can fix it yourself.
How to fix it:
- Sign in to Google with the admin account you use to connect the directory.
- Go to https://myaccount.google.com/connections, open CanIPhish Directory Integration and select Delete all connections. Make sure no CanIPhish entry remains.
- Wait about 5 minutes.
- Open a private or incognito browser window, sign in to CanIPhish and add the Google Workspace directory again with the same Google account. Google should show its full permissions screen; approve all permissions. If you're sent straight back to CanIPhish without that screen, the old approval is still active, so repeat step 2.
- If it still fails, connect with a different Google Workspace super admin account.
See also Appendix B in Google Workspace Employee Directory Synchronisation.
Not all scopes were authorised. Directory syncing may not function
Where: A warning on the Employees page after you connect a Google Workspace directory, or sign in again with Update directory (title: Directory Integration).
What it means: Google didn't grant every permission CanIPhish asked for, or CanIPhish couldn't read your directory's users and groups with the account you signed in with. The connection wasn't saved: a new directory doesn't appear under Directory Integration, and an existing directory keeps its previous connection.
How to fix it: Connect the directory again with a Google Workspace admin account, and make sure every permission is ticked before you continue. For a directory that's already listed, open Directory Integration, choose Update directory from its actions menu and sign in again. A directory whose status shows Issues Found (tooltip: "Not all scopes were authorised, so directory syncing may not function. Please reauthenticate the directory.") needs the same fix.
A sync error occured. Please try again.
Where: On the Employees page after you connect a directory (title: Directory Integration).
What it means: The sign-in didn't complete, for example because it was cancelled, so the directory wasn't connected.
How to fix it: Connect the directory again. If it keeps failing, contact support.
Error - The authentication tokens have expired. Please delete this directory and re-sync a new directory to regenerate new tokens.
Where: In the employee list dialog when it loads directory groups (title: Directory Loading Error). In Directory Integration, the directory's status shows Token Expired.
What it means: CanIPhish's access to your directory has expired or was revoked, so it can't read your groups.
How to fix it: You don't need to delete the directory, and you can't while employee lists sync from it. Instead, open Directory Integration, choose Update directory from the directory's actions menu and sign in again (Sign in with Microsoft or Google) to renew access. For Microsoft Entra ID, complete the admin consent step as well.
Other directory messages
| Message | What it means and how to fix it |
|---|---|
| Error - There are insufficient permissions to collect directory groups. (title: Directory Loading Error) | CanIPhish couldn't read your directory's groups with the stored connection. Choose Update directory and sign in again with an admin account, accepting every permission. For Microsoft Entra ID, make sure admin consent was granted. |
| Error - No groups were found! Please create a group in your Google Workspace account and try again. (title: Directory Loading Error) | Employee lists sync from Google Workspace groups, and this directory has none. Create a group that contains the employees, then try again. |
| Please contact us if this issue persists. (title: Directory Loading Error) | The groups couldn't be loaded for another reason. Try again, then contact support. |
| Error - Invalid Client Secret. Ensure the Client Secret Value has been supplied, and not the Client Secret ID. | White-labelled tenants that connect Microsoft Entra ID with their own app registration: enter the secret's Value, not its Secret ID. See Microsoft Entra ID Employee Synchronisation (For White-Labelled Tenants). |
| Directory group could not be found. (title: Group Lookup) | When a directory has 500 or more groups, only the first 50 are listed. To add another, type its full display name and press Enter. This message means no group has that name. |
| Error - Directory currently in-use. (title: Directory Deletion) | One or more employee lists still sync from this directory. Change or delete those lists first, then delete the directory. |
Sync Failure
These appear in the employee list dialog when you click Sync directory employees.
- Please select at least one directory group to sync. Choose one or more groups first.
- Please specify an employee list name before syncing a directory. Enter a name for the list first.
-
An error occured. Please contact the CanIPhish team for support The sync couldn't finish, so the list wasn't changed. Common causes are:
- A selected group no longer exists in your directory. For Microsoft Entra ID, missing groups are skipped and the sync fails only when none of the selected groups exist. For Google Workspace, any missing group stops the sync.
- CanIPhish's access to the directory has expired or lacks permissions. See the authentication tokens have expired above.
Creating and testing campaigns
| Message | What it means and how to fix it |
|---|---|
| There can only be a maximum of 20 active campaigns. Please archive a campaign before creating a new campaign. (title: Campaign Limit Reached) | You can have up to 20 campaigns on the Campaigns page at once. Archive campaigns you no longer need. |
| Email domain is not verified (dialog: Test email not sent in the campaign wizard, or Email Delivery Failure from a template preview) | Test emails can only go to addresses on a domain your tenant has verified. Send the test to an address on a verified domain, or verify the domain first under Employees > Verification. |
| This feature is unavailable because the Azure OpenAI subprocessor has been disabled under Platform Settings > Privacy Settings. (The message can name another subprocessor instead, such as ElevenLabs, Fal AI, Have I Been Pwned, Telnyx, Twilio or Veed.) |
The feature relies on a subprocessor that your organization has turned off. Turn it back on under Platform Settings > Privacy Settings, or use features that don't need it. Have I Been Pwned is the exception: it can't be turned back on in Privacy Settings, so activate dark web monitoring again instead. See Privacy Settings (Subprocessor Management) - Introduction. |
In the campaign wizard, a warning icon next to an employee list means some of its addresses are on an unverified domain; those employees won't receive emails.
Phishing and voice delivery statuses
A phishing campaign's statistics show each employee's delivery result in the Email Delivered column. Once you've fixed the cause, choose Resend email from the employee's actions menu to send the simulation again. If the resend fails, you'll see "The phishing email failed to deliver. The following failure message was provided:" followed by the reason (title: Email Delivery).
| Status | What it means | How to fix it |
|---|---|---|
| Failure - Domain Not Verified | The employee's email domain isn't verified in your tenant, so nothing was sent. | Verify the domain (Employees > Verification), then resend. |
| Failure - Email Quota Exceeded | Your monthly quota was used up when this email was due, so it wasn't sent. Your Platform Super Admin is also emailed with the subject "You've used your email quota!". | See Error - Maximum Quota Hit for how the quota works and how to get more. Then resend. |
| Failure - Connection to SMTP server was rejected | CanIPhish couldn't send the email through the mail server the campaign uses. | If the campaign uses your own SMTP server, check its host name, username and password, and use Test connectivity on the Manage Email Delivery Providers page (Platform Settings > Email Delivery Settings). See Mail Servers - Third-Party Integration. Otherwise, contact support. |
| Failure - Email bounced | The receiving mail server rejected the email. | Click the status to see the raw bounce response, which shows why. If your email security blocked it, see Allowlisting - Introduction. Then resend. |
| Failure - Authentication To Microsoft Unsuccessful | The campaign sends through Microsoft 365 Direct Email Injection, and CanIPhish couldn't sign in to your Microsoft 365 tenant with that integration, for example because its consent was removed. | Set up the Microsoft 365 Direct Email Injection integration again with the same integration name, and make sure admin consent is granted. See Microsoft 365 Direct Email Injection - Setup Guide. Then resend. |
| Failure - Employee Not Found In Microsoft 365 | Microsoft 365 Direct Email Injection couldn't place the email in this employee's inbox. This happens when the address doesn't match a mailbox in the Microsoft 365 tenant connected to the integration (CanIPhish matches the user principal name, primary email address and aliases), when the mailbox is hosted on an on-premises Exchange server, or when the integration wasn't given admin consent for all the permissions it needs. | Check that the mailbox exists in the Microsoft 365 tenant this integration is connected to. If you have more than one Microsoft 365 tenant, use the integration connected to the right one. Check admin consent for the CanIPhish Email Connector app (steps 6 to 10 of the setup guide). For on-premises mailboxes, use allowlisting instead. To test, send yourself a test email from the campaign wizard or a template preview, then resend. |
| Failure - Employee Not Found In Google Workspace | Google Workspace Direct Email Injection couldn't insert the email into this employee's Gmail inbox, for example because the address isn't a mailbox in your Google Workspace or the CanIPhish service account no longer has domain-wide delegation. | Check the mailbox exists, and check the delegation in step 2 of Google Workspace Direct Email Injection - Setup Guide. Use Validate Connection (open the integration with Update integration), then resend. |
Voice phishing campaigns show call results in the Call Delivered column:
| Status | What it means and how to fix it |
|---|---|
| Failure - No Phone Number Provided | The employee has no phone number in the employee list. Add it, in E.164 format. |
| Failure - Invalid Phone Number | The phone number isn't a valid international number. Use E.164 format: a plus sign (+) followed by the country code and number. |
| Failure - Phone Number Not Verified | The employee hasn't completed phone number verification. Verify numbers on the Phone numbers tab of the Verification dialog. See Step 2 of Voice Phishing - Getting Started Guide. |
| Failure - An Unexpected Error Occurred | The call couldn't be queued. Contact support. |
Training assignment statuses
A training campaign's statistics show any assignment problem in the Status column as Error - followed by the reason. Once you've fixed the cause, choose Reassign training from the employee's actions menu. If reassigning fails, you'll see "An error occured while re-assigning this training for this employee:" followed by the reason (title: Training Assignment Failure). See Campaigns - Introduction.
Error - Maximum Quota Hit
This can also appear as Error - Maximum quota hit.
What it means: Training wasn't assigned because your monthly quota was already used up. Your plan limits how many unique employees can be sent phishing simulations or assigned training each monthly period:
- Each unique employee who is sent a simulation or assigned training in the period uses one license. Employees already counted in the period don't count again.
- Removing someone from an employee list doesn't free their license until the next period starts.
- The number of people in your employee lists doesn't matter; only the people who are actually sent something count.
How to check it: The Campaigns page shows Quota Used and how many days remain Until Monthly Quota Reset. On plans that count employees, click [n] of [n] Monthly Employees to see everyone counted this month.
How to fix it:
- Wait for the quota to reset, or add licenses under Subscription & Billing. See How to purchase/upgrade a subscription. On Enterprise plans, Automatic Seat Upgrades - Enterprise Subscription Feature can add licenses automatically.
- Then choose Reassign training for each affected employee. To reassign everyone at once, you can save the campaign again with Update campaign; note that this withdraws all of the campaign's incomplete assignments and assigns the training again.
Error - Domain not verified
What it means: The employee's email domain wasn't verified when the training was due to be assigned, so nothing was assigned or emailed.
How to fix it: Verify the domain (Employees > Verification), then choose Reassign training.
Error - Pending Assignment
Where: Training campaigns with New employee sync turned on.
What it means: When people are added to one of the campaign's employee lists, CanIPhish first records them as Pending Assignment and then assigns their training one person at a time, which can take a few minutes for a large group. If the status doesn't clear, the assignment didn't go through, for example because your quota was used up or the employee's domain isn't verified. Employees with this status haven't been assigned training and haven't received the assignment email.
How to fix it: Check your quota and domain verification, then choose Reassign training for each affected employee. If reassigning fails, the notification gives the reason. If many employees stay on Pending Assignment and neither cause applies, contact support.
An error occured while sending the reminder notification to this employee: Error - Email Domain Not Verified
Where: After you choose Send reminder for an employee (title: Training Notification Reminder).
What it means: The employee's email domain isn't verified in your tenant any more, so the reminder wasn't sent.
How to fix it: Verify the domain (Employees > Verification), then send the reminder again.
Items you can't delete while a campaign uses them
Employee lists, content, delivery providers and directories can't be deleted while something still uses them. Archiving a campaign removes it from the Campaigns page, after which it no longer blocks a deletion. Before you archive a campaign that assigns training, see the tip under Error - Target currently in-use.
| Message | What you tried to delete | How to fix it |
|---|---|---|
| Error - Target currently in-use. | An employee list | See Error - Target currently in-use. above. |
| Error - Profile currently in-use. | A custom phishing email, phishing website or Email Sender ID (titles: Template Deletion or Profile Deletion) | Archive the campaigns that use it, then delete it. |
| Error - Module currently in-use. | A training module (title: Module Deletion) | A training campaign, or a phishing campaign with training, still assigns it. Archive those campaigns first. |
| Error - Template currently in-use. | A voice phishing template (title: Template Deletion) | Archive the voice phishing campaigns that use it first. |
| This voice is currently in use by the template '[name]'. Please update or remove the voice from the template before deleting. | A custom voice (title: Voice Deletion) | Change the named template to use another voice, then delete the voice. |
| Error - Mail instance currently in-use. | An email delivery provider (title: Delivery Provider Deletion) | A phishing campaign still sends through it. Archive those campaigns first. Training-only campaigns don't block this. |
| Error - Directory currently in-use. | A directory integration (title: Directory Deletion) | Change or delete the employee lists that sync from it first. |
Platform users and signing in
For the steps behind these, see Managing Platform Users and Account Ownership.
| Message | What it means and how to fix it |
|---|---|
| Error - [n]/[n] user quota used. Please contact CanIPhish to increase your quota. (title: Adding User) | Your tenant has reached its limit of platform users (50 by default). Remove users who no longer need access, or contact support. |
| Error - Account creation with addresses from free email services is not supported e.g. gmail.com, protonmail.com, etc.. (title: Adding User) | Platform users need an address on an organization's own domain. |
| Error - Cannot modify the account of a Platform Super Admin. (title: Adding User) | The address belongs to the Platform Super Admin, whose account can't be changed by other admins. The Super Admin can transfer the role first if needed. |
| It appears you don't have access to a tenant. Please contact your tenant administrator to request they assign a role to your email address. (title: Sign in error) | The account no longer has access to any tenant, for example because it was removed from User Management or its tenant was closed. Ask a Platform Admin to add you again. |
| It appears that the administrator of your tenant has enabled Single Sign-On (SSO). Please log in using SSO instead of using direct authentication. (title: Sign in error) | Your tenant uses Platform SSO. Click Continue with single sign-on on the sign-in page. If you can't use SSO, ask a Platform Admin to add you to the Direct Login Allowlist. |
| Error: A Single Sign-On (SSO) provider couldn't be located. Your administrator may not have setup SSO. Please try logging in directly. (title: Sign in error) | Platform SSO isn't active for your account's tenant. Sign in with your email address and password. |
| Error - Please log in using Single Sign On. (title: Sign up error) | You tried to create a password for a tenant that uses Platform SSO. Sign in with SSO, or ask a Platform Admin to add you to the Direct Login Allowlist first. |
| There was an error performing the MFA reset. If the issue persists, please contact the support team. (title: MFA Reset) | The reset didn't go through. Refresh the page and try again, then contact support. |
Scheduled reports and notifications
| Message | What it means and how to fix it |
|---|---|
| Error - Recipient email domain is not verified (title: Update Error) | Scheduled reports can only be sent to addresses on a domain your tenant has verified. Change the recipient, or verify their domain under Employees > Verification. |
| Error - Invalid recipient: [address] (title: Update Error) | One recipient isn't a valid email address. Check it for typos. |
| Error - Email domain is not verified, or: An error occured. Please ensure the email used is from a verified domain. If this issue persists, contact the CanIPhish team. (title: Notification Test) | Test notifications can only go to an address on a verified domain. Enter one, or verify the domain first. |
Messages that ask you to contact support
Messages such as Error - Please contact the support team. (title: Settings not saved) or An update error occured. Please try again. (title: Update Error) mean your change wasn't saved. Refresh the page and try again. If it happens again, contact the CanIPhish support team with the page you were on, the time, and a screenshot that shows the message.
Comments
0 comments
Please sign in to leave a comment.