What is the cause of the error "Failed to complete run scan. Please try again." Status is 403 forbidden”?

In the context of Spirion Sensitive Data Platform (SDP), this error typically stems from one of the following 3 causes:

1. Console-to-Target Authentication (Cloud Targets)

This is the most common cause for 403 Forbidden errors when scanning cloud ecosystems like Microsoft 365 (OneDrive, SharePoint, Exchange) or Google Drive.

• Expired/Revoked OAuth Token: The OAuth consent or "Enterprise Application" token used by Spirion to access the cloud environment has expired, been revoked, or the underlying service account has been disabled.
• Insufficient Scopes: The application was granted some permissions, but not the specific ones required to enumerate or read the data in the current scan scope (for example, it can see the site list but is "Forbidden" from reading file content).
• Conditional Access Policies: Your organization's security policies (for example, Azure AD Conditional Access) may be blocking the Spirion service's IP address or service principal from accessing the data.

2. Console-to-Agent Communication (RBAC Scoping)

If you see this error while trying to manually trigger a scan from the console:

• Role-Based Access Control (RBAC) Restriction: Your user account in the Spirion Console may not have the necessary permissions to execute scans on the specific Agent Tags or Target Tags included in that scan definition. The console returns a 403 because you are "Forbidden" from managing those specific assets.

3. Agent-to-SaaS Ingress Rejection

If the error appears in the Job History after a scan has already started:

• Ingress Blocking: The Agent is attempting to ship results or status updates to the Spirion SaaS Ingress service, but the request is being rejected. This can happen if the Agent's registration has been invalidated or if there is a mismatch between the Agent's tenant ID and the console's expected ID.

Recommended Troubleshooting Steps

Perform the following Troubleshooting steps to resolve the error "Failed to complete run scan. Please try again." Status is 403 forbidden”

1. Re-Authenticate the Target: If this is a cloud scan (M365/Google), go to the Targets page and re-run the OAuth consent flow to refresh the tokens.
2. Check User Permissions: Verify that your console user role has "Execute" permissions for the scan definition and the Agents/Targets involved.
3. Verify Agent Health: Ensure the Agent is "Online" and heartbeating. If the Agent is in an "Error" or "Unregistered" state, it is forbidden from processing new work.
4. Review Target Logs: If scanning a cloud Target, check the audit logs in the target system (for example, Azure AD Sign-in logs) to see if the Spirion service principal is being explicitly blocked.