Q: Was an old-dated email with a link sent by you, and is it safe to open?

Usually, messages like this are automatically sent training reminders from the system about incomplete trainings. The year shown in the message (e.g., 2025) refers to the training version information, not to an indication that the message is a phishing attempt. In these cases, the message has been sent by us and is safe. If you are unsure about the authenticity of an individual message, do not click the link; instead, contact Granite customer support. Based on log data, we can verify whether the message was sent from our system.

Question 1

Why doesn’t automatic user provisioning from Entra ID add new users to production groups?

Accepted Answer

Usually, the reason lies in Entra ID provisioning settings (group scoping and attribute mappings).

Before contacting support, ask your Entra/Azure AD administrator to check at least the following:

Verify that the correct users and groups are being provisioned

Make sure Enterprise Application–level user assignments are correct: production users/production groups must be assigned to the Granite application in Entra ID, and provisioning is not limited to only test users.
Remove accounts from provisioning groups that should not be provisioned (otherwise Entra will try to provision unwanted accounts as well, and the logs will fill with errors).

Check the email address and other required user attributes

The Granite SCIM interface requires the attribute "emails". If it is missing, provisioning fails and errors appear in the Entra ID provisioning logs, for example:
- "Required property missing: emails" or
- ErrorCode: SystemForCrossDomainIdentityManagementServiceIncompatible
In the Entra portal, ensure SCIM attribute mappings:
- that "emails" is included in the SCIM mapping
- that it is populated from Entra ID user objects (not empty for any provisioned user)
- that all other required attributes are included and have values for users /

Check provisioning logs in the Entra portal

Open the Entra ID provisioning logs for the Granite application and look for:
- entries with "Required property missing: emails" or other SCIM

Question 2

Clicking the password reset link gives an error message “The reset link has expired.” What should I do?

Accepted Answer

|| Password reset links are single-use and time-limited. This error usually occurs because you are using an old link, the link has already been used once, or your browser/email client is handling the link in an unexpected way.

Try the following:

Request a new password reset link using the “Forgot your password?” function on the login page and use the link immediately after receiving it. Also check your spam/junk email folder if needed.
Always use the most recent link: if you request multiple links, earlier ones will expire. Do not open the same link multiple times.
Open the link in another browser or in a private/incognito window. If necessary, try another device (e.g., a computer if it does not work on mobile).
If clicking the link directs you to the Granite login page instead of the password reset view, copy the link from the email and paste it manually into your browser’s address bar.
Update your browser and clear the cache/cookies before trying again.
If the error persists or you receive other messages (e.g., “No access rights” or “Account locked”), the issue may be due to a temporary disruption or an access rights problem. Try again later or contact Granite support.

When contacting Granite support, include the following:

The email address/username to which the reset link was sent
When you requested the link and when the message was received
The Granite website URL (starting with https://) that you are trying to access
A screenshot of any

Question 3

What should I do if SAML/IdP authentication fails (e.g., “connection timed out” or ERR_CONNECTION_TIMED_OUT) and I cannot log in?

Accepted Answer

If SAML/IdP authentication fails with a connection timeout error (e.g., “ERRCONNECTIONTIMED_OUT”) and you cannot access Granite, the cause may be a temporary server connection issue in Granite’s system. In this case, logging in will not succeed until the issue has been resolved in Granite’s server environment. Do the following:

Wait a moment and try logging in again. The issue may be temporary, and login may start working again shortly.
If the error persists, contact Granite customer support. Mention that you are using SAML/IdP login and are receiving a timeout error (e.g., “ERRCONNECTIONTIMED_OUT”). Provide the time when the error occurs and the Granite environment you were trying to access (e.g., company.granitegrc.com).
Wait for confirmation from support. Support will investigate the status of Granite’s system, identify any server connection issues, and resolve them. After that, you will be asked to confirm that login works again.

Please note that any work in progress may be interrupted during the connection issue. If you are still unable to log in after the issue has been resolved, reply to the support request and describe what happens (include the exact error message and time) so the issue can be investigated further.

Question 4

I receive an error message "No access rights to the system" when logging in. What does this mean?

Accepted Answer

|| The error message means that your account does not have permissions to access any tools available in the service environment.

Common reasons include:

You have completed your first login to Granite, and only then was your user account created on the Granite side. Once the account has been created, your organization’s Granite admin user can grant you access rights.
Your access to the tool or training has ended, and there are no active permissions.
You are logging into the wrong URL or environment, or you are using the wrong authentication method (organization-based login vs. Granite’s separate username and password).
Your organization’s AD group membership does not grant you automatic access rights.
In rare cases, the issue may be caused by a temporary server disruption.
Your organization’s contract or subscription with Granite has ended, and the service has been closed.

| How to resolve the issue:

Verify the correct login address and authentication method

Use your organization’s single sign-on (SSO) (e.g., HAKA, Azure AD/Windows/KamIT) if it is in use. If you do not receive a password reset email, SSO is likely enabled.
If you have previously used another environment or employer, you may need a new user account. Request a registration link for the correct environment or follow your organization’s internal instructions.

Have your access rights checked within your organization Contact your organization’s main user (admin) or tr

Question 5

Can an individual user disable two-factor authentication (2FA) on their own account?

Accepted Answer

An individual user cannot disable two-factor authentication (2FA) on their own account if 2FA is enforced through system role settings (e.g., the default role).

Even if your user profile appears to show a "Disable" button or icon for 2FA, it does not override role-based enforcement. When 2FA is tied to a role, the setting comes from the role rather than the user’s personal settings.

If 2FA is not enabled through the default role and you want to disable it, do the following:

Click your name in the top-right corner and select your user account.
Go to Security and then click the Disable button.
2FA will now be disabled for your account.

If, for example, you have changed your phone and need to reset your 2FA code, please contact support at tuki@granite.fi.

Question 6

Was an old-dated email with a link sent by you, and is it safe to open?

Accepted Answer

Usually, messages like this are automatically sent training reminders from the system about incomplete trainings.

The year shown in the message (e.g., 2025) refers to the training version information, not to an indication that the message is a phishing attempt. In these cases, the message has been sent by us and is safe.

If you are unsure about the authenticity of an individual message, do not click the link; instead, contact Granite customer support. Based on log data, we can verify whether the message was sent from our system.

Frequently Read Articles

Browse All Categories