--- title: "Admin messages" slug: "admin-messages-v6-6" updated: 2025-12-22T20:01:03Z published: 2025-12-22T20:01:03Z canonical: "support.appgate.com/admin-messages-v6-6" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.appgate.com/llms.txt > Use this file to discover all available pages before exploring further. # Admin messages The dashboard includes a message feed. These messages are likely to relate to the settings/configuration of the wider system. They might indicate a configuration issue within the AppGate ZTNA Collective, with a related system (such as IdP), or the network environment (such as DNS). | Source | Error Level | Message | Action to be taken | | --- | --- | --- | --- | | ZTP | Error | Failed to communicate with Risk Engine. | One of the Controllers was not able to talk to the ZTP service. Make sure the Controllers can reach the ZTP service. | | ZTP | Error | ZTP registration has been revoked. Contact your ZTP administrator for more details. | The ZTP account is no longer valid, please check with your ZTP administrator to get valid credentials that allows you to connect to ZTP. | | Controller | Warning | Trusted Network Detection settings are defined in more than one active Policy for a user. The setting from Policy is being used because it comes first alphabetically. | This means that one or more users have a conflicting setting for Trusted Network Detection in the Polices (Most likely on device Policy or the device section in mixed Policies). Check which user has the assigned, go to session details and run analyze Policies. This will tell which items are conflicting and adapt the access criteria to make sure there is no more conflict for the Policy setting. | | Controller | Warning | Identity Provider does not have IP Pool assigned. | The Identity Provider mentioned in the admin message has no IP pool assigned. This means user can authenticate against the IDP, but will get an error as the Controller is not able to assign a tunnel IP from the pool. | | Controller | Warning | Failed to allocate IP from pool : | The Controller was unable to assign an IP from the pool to this user, due to the . In most cases this means the IP pool is full on this Controller. If only 1 Controller is giving this error and the IP pool in IP pool list shows still available IPs, please make sure that the users can reach all Controllers, because each Controller is responsible for allocate its percentage of the IP pool. | | Controller | Warning | Failed to map to IP Pool because it doesn't exist. Mapping is defined on Site | The Controller was unable to map the tunnel IP of the IP pool to a mapped IP pool for Site . Please make sure the mapping is configured correctly on Site settings, and that the mapped IP pool still has available IPs in the pool. | | Controller | Warning | Failed to retrieve details from the Identity Provider . Please check the configuration and connectivity. | The Controller is not able to communicate with the identity provider. Please verify the identity provider settings for the mentioned identity provider, verify the configuration, the certificates (if applicable) and the connectivity between the mentioned Controller and the identity provider. | | Controller | Error | Controller has failed to verify metered EC2 instance state. Failures lasting longer than 1 hour prevent users signing in on this Controller. Details: | This error will only occur when you are using a metered subscription instance from AWS. The Controller is not able to talk the metered subscription API from AWS and therefore cannot use metered license model. This error will impact users signing in in after 1 hour, it will not impact connected users. | | Controller | Warning | One or more of your licenses has an error. Please check your licenses and remove the ones with errors. | One of the uploaded licenses is incorrect or expired. Please sign in into the admin UI, go to Settings > Licenses and verify the licenses there are correct. If not, please [contact support](/v1/docs/contacting-support). | | Controller | Error | Identity Provider has failed to authenticate a user. Details: | The identity provider mentioned in the admin message failed to authenticate a user. The message will show more details why the user has failed to sign in. Please verify your identity provider to investigate why this user failed to authenticate. | | Controller | Warning | Criteria Script for Client Auto-Update is not available. Reassign it to an existing Criteria Script in order to fix this issue. | The criteria script used to select users for Client auto-update service is no longer available. Please go to System > Client Auto-Update and select an existing criteria script. | | Controller | Warning | Device Proxy Auto Config URLs matches are defined in more than one active Policy for a user. The setting from Policy is being used because it comes first alphabetically. | This means that one or more users have a conflicting setting for Device Proxy Auto Config URL in the Policies (Most likely on device Policy or the device section in mixed Policies). Check which user has the assigned, go to session details and run analyze Policies. This will show which items are conflicting and then adapt the access criteria to make sure there are no more conflicts in the Policy setting. | | Controller | Warning | Client settings are defined in more than one active Policy for a user. The setting from Policy is being used because it comes first alphabetically. | This means that one or more users have a conflicting setting for Client settings in the Policies (Most likely on device Policy or the device section in mixed Policies). Check which user has the assigned, go to session details and run analyze Policies. This will show which items are conflicting and then adapt the access criteria to make sure there are no more conflicts in the Policy setting. | | Controller | Warning | Multiple active Policies for a user have defined DNS settings for the same domain name . The setting from Policy is being used because it comes first alphabetically. | This means that one or more users have a conflicting DNS domain setting in the DNS Policies. Check which user has the assigned, go to session details and run analyze Policies. This will show which items are conflicting and then adapt the access criteria to make sure there are no more conflicts in the Policy setting. | | Controller | Warning | Multiple Custom Help URLs are defined in more than one active Policy for a user. The setting from Policy is being used because it comes first alphabetically. | This means that one or more users have a conflicting Custom Help URL setting in the Device Policies. Check which user has the assigned, go to session details and run analyze Policies. This will show which items are conflicting and then adapt the access criteria to make sure there are no more conflicts in the Policy setting. | | Controller | Warning | Client profile settings are defined in more than one active Policy for a user. The setting from Policy is being used because it comes first alphabetically. | This means that one or more users have a conflicting Client profile setting in the Device Policies. Check which user has the assigned, go to session details and run analyze Policies. This will show which items are conflicting and then adapt the access criteria to make sure there are no more conflicts in the Policy setting. | | Controller | Warning | A user did not get the Entitlement because it doesn't have a Site assigned. | Go to Access > Entitlements and select the named Entitlement. Make sure it has a valid Site assigned. | | Controller | Warning | A user did not get the Entitlement, because its Site doesn't have any active Gateways assigned. | The Site that is allocated to the Entitlement has no active Gateways assigned. Go to System > Appliances and either seed a new Gateway or select an existing one and assign the proper Site to it. | | Controller | Warning | A user on Identity Provider received one or more Site routes from that is IPv(4/6) but did not get an IP allocated for it. Consider assigning an IPv(4/6) pool to the Identity Provider. | If for example IPv6 Entitlements are used, but identity provider has no IPv6 pool assigned, the users will not be able to reach the Entitlement | | Controller | Warning | One or more Policy Override Sites could not be found while trying to apply to Entitlement . Please review your Policies. | Check which Policy has an assignment for the named Entitlement either directly or via tag, and make sure that the specified override Site still exists. | | Controller | Warning | One or more Policy Override Sites could not be found while trying to apply to Entitlement . Please review your Policies. | There is more than one Policy match for the named Entitlement and they have a different override Sites specified. Make sure to update the criteria scripts for all conflicting Policies. | | Controller | Warning | At least one of your Policies is configured with override Site using the claim , but that claim could not be found. Please review your Policies. | Check the claim name for Policies that use 'Override using a Claim'. And either fix the claim in identity provider mapping, or update the claim name in the Policy for the override Site setting. | | Controller | Warning | At least one of your Policies is configured with override Site using the claim , but that claim does not contain a UUID. Please review your Policies. | Please make sure the mentioned claim name has the correct Site UUID. The Site UUID can be found if you go to the specific Site settings and copy the UUID part form the admin UI URL. | | Controller | Warning | was unable to sign in as admin because there was no Policy match. | Please make sure you have a proper admin Policy matched for this user. If there is no admin Policy active at all, please see our knowledge base to remediate. | | Gateway | Warning | The Client with DN: is showing abnormal high signalling towards the Gateway, and has been loadlimited, until: