Why can a user sign in but not see a module, cycle, or action?
A successful sign-in confirms authentication, not access to every feature. Check the tenant, profile, module, scope, eligibility, process status, and permissions.
Follow this troubleshooting flow
Confirm that the user signed in to the correct organisation, environment, and domain.
Identify the exact module, cycle, page, button, or action that is missing.
Check that the user's account is active and has the intended platform and Backoffice roles.
Confirm that the module or feature is enabled for the organisation.
Review the user's groups, team, organisational scope, profile, and any eligibility rule used by the process.
Check whether the cycle, form, or action is open and available for that role and process status.
Compare the user with another person who should have the same access, checking one relevant difference at a time.
After an authorised role or scope correction, ask the user to sign out, start a new session, and check again.
What does a successful sign-in confirm?
It confirms that the authentication method accepted the user. It does not confirm that the user has the required role, group, organisational visibility, process eligibility, or module access. Resetting the password normally does not resolve a missing module or action when sign-in already works.
How do I distinguish the main causes?
The user cannot sign in: check the domain, authentication method, account state, SSO flow, and exact error message.
The user signs in but a whole module is missing: check feature availability and the user's role or profile.
The module is visible but a cycle or person is missing: check scope, groups, population, and eligibility.
The page is visible but an action is missing: check the responsible role, process status, dates, and configured permissions.
What can an administrator do safely?
Verify the intended access with the organisation and apply only authorised profile, group, or scope corrections. Do not create a duplicate account, disable SSO, move the user between groups, or grant a broader role merely to test whether an action appears.
When should I contact Support?
Contact Support when the correct tenant, account state, feature, role, scope, eligibility, and process status are confirmed but access remains missing. Include the user identifier, environment, authentication method, missing module or action, intended role, relevant groups or scope, cycle, and any message shown.
Continue troubleshooting
User profile: overview, recognition, evaluation and careers: review the user's Backoffice record and assigned information.
Why is a user not eligible for a Touchpoint or evaluation?: investigate access to evaluation processes.
How to Configure SAML 2.0 SSO with Microsoft Entra ID for the GFoundry Platform: review SSO configuration when authentication itself fails.