| Adapter says permissions not approved, though consent shows green ticks | Permissions are Delegated, not Application | Add the Application versions, remove the Delegated duplicates, grant admin consent again |
| AADSTS901001: prompt 'admin_consent' is invalid | prompt=admin_consent is a v1.0 value sent to a v2.0 endpoint | Use prompt=consent or select_account; admin consent belongs on /v2.0/adminconsent |
| Sign-in blocked with Need admin approval | The request asks for scopes outside what was consented | Sign in with a Global Administrator and accept, or check whether .default crept into the scope string |
| Connected, zero rooms discovered | Room exists but is not in a room list, or the index has not caught up | Confirm with Get-DistributionGroupMember, then wait |
| Get-Place returns nothing for a room that exists | Created as Equipment, or indexing pending | Set-Place -Type Room, otherwise wait |
| 404 ErrorInvalidUser on a calendar call | That address has no mailbox — usually a typo or a placeholder name | Confirm the real address with Get-Mailbox |
| 403 on /users/{address} while calendar calls succeed | Needs User.Read.All, which the adapter does not request | Ignore — only the Directory screen is affected |
| 403 on calendar calls themselves | An application access policy is excluding the app | Test-ApplicationAccessPolicy; remove or widen the policy |
| Room shows as Busy with no title in Outlook | Free/busy-only permission on that calendar | Add-MailboxFolderPermission ... -AccessRights Editor |
| Bookings arrive with the organiser's name as the title | DeleteSubject and AddOrganizerToSubject at their defaults | Set both to $false |
| Adapter stops working with no code change | The client secret expired | Create a new secret, update the environment, note the next expiry |