Troubleshooting
Common problems with Discover AI (Shadow AI) and how to fix them. For directory sync, see Directory Integration > Troubleshooting.
A device does not appear under Devices
A device appears after one of its clients checks in. Check:
- The enrollment script ran for the right user. It must run as the person who uses the device, not as a separate admin account. With MDM, it must run as the logged-in user.
- The client started after the script ran. Restart the browser, or restart the desktop agent, so it reads the new managed settings.
- The time range. Devices lists devices with activity in the selected range. Widen it to Last 30 days.
- Network access. The client must reach your ANTS Platform host over HTTPS. Check proxies and firewalls.
A device shows Degraded
Degraded means the device is online but something needs attention. Hover the health badge in the table, or open the device and look at Installs. Common reasons:
- An install is offline. A device with several clients is Degraded when any of them has not checked in for 70 minutes, for example a browser that is closed. The reason reads like "1 of 3 installs offline".
- Missing macOS permissions. The macOS agent needs Accessibility. Also check Full Disk Access, Network Extension and Endpoint Security in System Settings > Privacy & Security, or deploy the PPPC and system extension profiles through MDM.
- Upload failures or a retry backlog. 3 or more upload failures, or 100 or more events waiting to retry. Usually a network problem; it clears after successful uploads.
- A collector reporting a problem. The install card lists the affected collectors.
A device shows Offline
No check-in for more than 70 minutes. Clients check in about every hour. The device may be off, asleep or off the network, or the client may have been removed. If the device is on and online, treat it as a device that does not appear.
The browser extension is not connected
Open the extension popup and read its status:
| Popup status | What to do |
|---|---|
| Sign in to start sending events | The extension has no credentials. Re-run the enrollment script for this user, restart the browser, and check again. With MDM, confirm the 3rdparty credential policy was pushed for the right browser. Chrome, Edge and Firefox use different policy paths. |
| Keys rejected by backend | The project keys changed. Download the enrollment script again and re-run it, or push the updated MDM policy. |
| Backend unreachable | The browser cannot reach your ANTS Platform host. Check proxies and firewalls. The extension keeps retrying. |
| Re-enrollment required | Re-run the enrollment script. |
| Last send: missing_device_id | The device identity is missing from managed settings, so events are not uploaded. Re-run the enrollment script, or check your MDM configuration profile. |
| This device was blocked by your organization | An admin blocked the device. Unblock it under Discover AI > Devices, then re-enroll. |
| Access was revoked by your organization | The device's certificate was revoked. Re-run the enrollment script to enroll again. |
An extension version below 0.1.18 cannot enroll from the enrollment script. Update the extension. The Devices table flags these versions in amber.
For a managed install, check chrome://extensions, edge://extensions or
about:addons. The extension should show "Installed by your administrator".
No data, even though the device is Healthy
- Use an AI tool. Data appears only after someone uses a tool. Usage usually shows within a few minutes. Some figures are cached for up to about 5 minutes.
- The tool is not in the registry. Only registry tools and your internal AI tools are detected. Add a private tool as an internal AI tool or nominate a public one.
- The right client is not installed. Websites need the browser extension. Desktop apps and command-line tools need the desktop agent. Coding agents can also report through OpenTelemetry. Safari is not supported.
- A collector is switched off. Check the collector settings under Settings > Deployment & Keys > Enroll devices.
- A command-line run did no work. CLI sessions count only when the run had at least one prompt, tool call or token.
Clients return 401 or stopped reporting
This usually follows a change to keys or authentication:
- Immediate rotation or Revoke all credentials stops the old keys at
once. Every client gets
401until it has the new keys. Re-run the enrollment script on each device, or push the updated MDM policy. For routine rotation, use graceful rotation, which keeps the old keys working for 7 days. See Project keys. - Switching to device certificates refuses every client that has no active certificate. Re-enroll those devices. The Authentication method card shows how many devices still lack a valid certificate.
- A revoked or blocked device gets
401and stops collecting. See Device actions.
Device certificate enrollment fails
| Symptom | Cause and fix |
|---|---|
Enrollment fails with 503 and issuer_unavailable | Your deployment has no certificate authority configured. Switch back to API keys or contact your ANTS Platform account team. |
410 with expired or revoked | The fleet enrollment credential expired (default 24 hours) or was revoked. Download the enrollment script again, or generate a new credential. |
410 with device_already_registered | This device already redeemed the credential. Run the uninstall script from Enroll devices > This machine to release it, then enroll again. |
403 with device_blocked | The device is blocked. Unblock it under Discover AI > Devices. |
429 | Too many enrollments for the project in the last hour. Wait and retry. |
The MCP Servers tab is empty
MCP servers are reported only by the macOS agent, and only from Claude Code, Claude Desktop, GitHub Copilot and Gemini CLI. Windows devices and older macOS agents do not report them. See MCP Server Inventory.
Departments show as "No department"
Department comes from the device (written by the enrollment script) or from a directory. Connect Okta or Entra ID under Organization Settings > Integrations. See Directory Integration.
AI tokens shows "No OTEL"
No token data was recorded in the period. Token counts come from coding-agent telemetry and from the desktop agent's reading of supported tools' local session files. See Coding-Agent Telemetry.
Coding-agent telemetry is not arriving
See Coding-Agent Telemetry > Troubleshooting.
Still stuck?
Note the device's health reasons and recent check-ins from Discover AI > Devices, your deployment method (self-serve or MDM, and which platform), and the extension popup status, then contact your ANTS Platform account team.