---
title: "Team workspace problems"
description: "Fix team workspace setup, GitHub CLI, pipeline, publish, preview, invitation, and Repair problems."
url: https://spatney.github.io/rayfin-fabricator/docs/troubleshooting/team
markdown_url: https://spatney.github.io/rayfin-fabricator/docs/troubleshooting/team.md
app_version: "1.20.1"
section: troubleshooting
product: Fabricator
last_updated: 2026-10-05T22:02:01-07:00
source: troubleshooting/team.mdx
---

# Team workspace problems

> Fix team workspace setup, GitHub CLI, pipeline, publish, preview, invitation, and Repair problems.

> [!WARNING]
> Team workspaces are an experiment. Turn them on in **Settings → Experiments**. They may change or be removed in a future update.

Use this page when a team workspace setup, preview deploy, publish, invitation, or pipeline repair does not finish.

## A team step failed and the message doesn't explain it

You see setup stop on a step, **Pipeline health** shows a problem, joining a workspace fails, or a preview or publish run fails, and Fabricator's message doesn't say what to change.

Team workspaces depend on Microsoft Entra ID, Fabric, and GitHub settings that your organization controls, so the same step can fail for different reasons. **Diagnose with Copilot** checks those settings and explains the most likely cause.

1. Select **Diagnose with Copilot** where the problem is shown:
   - in the setup window, under the problem
   - in **Join a team workspace**, under the error
   - in the workspace overview, in **Manage** → **Settings** → **Pipeline health**
   - in the app's team menu next to **View logs**, in the **Publish** window, or in **Pipeline log**
   - in the workspace overview, on a failed preview or published app, or next to a failed run under **Deployments**
2. Wait while Fabricator runs read-only checks with your GitHub and Azure sign-ins and Copilot reviews what they found. Select **Stop** to cancel.
3. Read **Most likely cause**, then follow **What you can do**.
4. If an administrator has to change a setting, copy the message under **What to ask your administrator** and send it to them.
5. When the change is made, select **Retry** or **Repair**, or publish again.

The diagnosis doesn't change anything in Microsoft Entra ID, Fabric, GitHub, or your files, and each one uses Copilot requests. Copilot can be wrong, so check its answer before you change settings. Select **Details sent to Copilot** to see everything it received.

If it still fails, include the diagnosis when you [report a problem](https://spatney.github.io/rayfin-fabricator/docs/troubleshooting/report-a-problem).

## Setup needs an administrator

You see setup stop on an identity, trust, access, or verification step. Fabricator may show "Your organization doesn't let you create or change app registrations in Microsoft Entra ID." It may also say "The pipeline signed in, but Fabric refused it."

This happens when your organization blocks app registration changes, or when Fabric service principal API access is not enabled.

1. Select **Diagnose with Copilot** to find out which setting stopped the step and which administrator can change it.
2. Select **Copy instructions for your admin** if Fabricator shows it.
3. Send the copied text, or the message from the diagnosis, to the right Microsoft Entra ID or Fabric administrator.
4. If the administrator gives you an application client ID, paste it into **App registration from your administrator** or **Existing app registration (optional)**.
5. Select **Retry**.

If it still fails, include the setup step and copied instructions when you [report a problem](https://spatney.github.io/rayfin-fabricator/docs/troubleshooting/report-a-problem).

## Setup can't create the GitHub repository

In **Create a team workspace**, the organization you chose as **GitHub owner** says "doesn’t let you create repositories". Or setup stops on **Create the private GitHub repository** with a GitHub error, such as "You need admin access to the organization before adding a repository to it."

Many organizations don't let their members create repositories. Setup needs to create the workspace's repository, or to use one that someone created for it.

1. Ask an owner of the organization to create an empty private (or internal) repository for the workspace and give you the **Maintain** role on it. **Admin** works too.
2. In **Create a team workspace**, under **GitHub repository**, select **Existing repository**.
3. In **Repository**, choose it from the suggestions or enter it as `owner/name`. You can also paste its GitHub address.
4. Select **Create workspace**.

See [Use an existing repository](https://spatney.github.io/rayfin-fabricator/docs/team/create#use-an-existing-repository). If it still fails, select **Diagnose with Copilot**, then [report a problem](https://spatney.github.io/rayfin-fabricator/docs/troubleshooting/report-a-problem).

## The organization locked the repository until it's set up

You see "`<organization>` locked `<repository>` until it's set up in the organization's portal, so `<account>` can't change it yet." when you create a workspace. On GitHub, the repository's description says "To gain access, please finish setting up this repository now at:".

Some organizations lock every new repository until someone finishes setting it up in the organization's portal. Microsoft's `microsoft` organization does this. Until then, even the person who created the repository can only read it. That's true of a repository you created on github.com, and of one setup just created, in which case setup stops on **Add the deploy pipeline to the repository**.

1. In Fabricator, select **Finish setting up the repository**. The portal opens in your browser.
2. Complete the portal's steps. Make sure your GitHub account ends up with the **Maintain** or **Admin** role on the repository.
3. Return to Fabricator and select **Create workspace** or **Retry**.

If Fabricator doesn't show **Finish setting up the repository**, open the repository on GitHub and follow the link in its description or website. If it still fails, select **Diagnose with Copilot**, then [report a problem](https://spatney.github.io/rayfin-fabricator/docs/troubleshooting/report-a-problem).

## The pipeline's sign-in fails with AADSTS7002381

Setup stops on **Check that the pipeline can reach Fabric** with "Your Microsoft Entra ID only accepts the pipeline's sign-in from repositories owned by organizations in the GitHub enterprises …". Or the pipeline's log shows `AADSTS7002381` and says the token "must contain the enterprise claim".

Some companies' Microsoft Entra ID only trusts GitHub Actions in their own GitHub enterprise. Microsoft's own tenant, for example, only accepts the `microsoft`, `github`, and `microsoftopensource` enterprises. GitHub only says which enterprise a repository belongs to when an organization in that enterprise owns it. A repository owned by a personal account, including a managed user's own repository, can't sign in. No setting in the pipeline or the app registration changes that.

1. In the setup window, select **Abandon setup…**, then select **Delete and abandon**. See [Abandon an unfinished setup](https://spatney.github.io/rayfin-fabricator/docs/team/create#abandon-an-unfinished-setup).
2. Create the workspace again, and choose an organization in one of those enterprises as the **GitHub owner**.
3. Or, under **GitHub repository**, select **Existing repository** and enter one of that organization's repositories where you have the **Maintain** or **Admin** role. An owner of the organization can create one for you. See [Setup can't create the GitHub repository](#setup-cant-create-the-github-repository).

If it still fails, select **Diagnose with Copilot**, then [report a problem](https://spatney.github.io/rayfin-fabricator/docs/troubleshooting/report-a-problem).

## GitHub says the organization requires single sign-on

You see a message such as "The microsoft organization requires single sign-on (through the microsoftopensource enterprise), and the GitHub CLI's sign-in for `<account>` isn't authorized for it yet." when you create or join a workspace.

The organization uses SAML single sign-on. GitHub lets the GitHub CLI into the organization only when you sign the GitHub CLI in to GitHub while you have a single sign-on session in your browser. Seeing **GitHub CLI** under your account's authorized applications on github.com isn't enough. The authorization link in GitHub's error message is for personal access tokens, so it doesn't help the GitHub CLI.

When the organization belongs to a GitHub enterprise that runs single sign-on for all its organizations, its single sign-on page is the enterprise's. For example, the `microsoft` organization's page belongs to the `microsoftopensource` enterprise. A session there covers the organization.

1. In your browser, make sure you're signed in to github.com as the GitHub account the workspace uses, the one the message names.
2. In Fabricator, select **Open single sign-on**. Continue with your work account in your browser.
3. In Fabricator, select **Sign in to GitHub again**. Finish signing in in the terminal window and your browser.
4. Return to Fabricator and try again: select **Create workspace**, **Retry**, or **Join**.

If Fabricator doesn't show **Open single sign-on**, open `https://github.com/orgs/<organization>/sso` in your browser instead.

If it still fails, sign the GitHub CLI out of that account everywhere and sign in again, as GitHub recommends:

1. On github.com, open **Settings** → **Applications** → **Authorized OAuth Apps**, and revoke **GitHub CLI**.
2. Open the organization's single sign-on page again, then select **Sign in to GitHub again** in Fabricator.

If that doesn't work either, [report a problem](https://spatney.github.io/rayfin-fabricator/docs/troubleshooting/report-a-problem).

## GitHub CLI is missing, signed out, or missing scopes

You see "The GitHub CLI (gh) isn't installed. Install it from setup, then try again." You may also see **Sign in to GitHub** or **Grant GitHub access**, or a message such as "the GitHub CLI's sign-in for `<account>` has expired or was removed. Sign in to GitHub as `<account>` again."

Fabricator needs `gh` on PATH, signed in to `github.com` with `repo`, `read:org`, and `workflow`. Each team workspace uses the GitHub account it was created or joined with, so that account must stay signed in to the GitHub CLI even when another account is active.

1. Install the GitHub CLI from setup if it is missing.
2. Select **Sign in to GitHub** if you are signed out.
3. Select **Grant GitHub access** if Fabricator lists missing scopes.
4. If the message names an account, sign in to GitHub as that account again: next to **GitHub account**, select **Add account**, or run `gh auth login` and sign in as it. To use another account instead, see [Change the GitHub account](https://spatney.github.io/rayfin-fabricator/docs/team/overview#change-the-github-account).
5. Finish the terminal sign-in or refresh flow.
6. Return to Fabricator and select **Check again**.

If the terminal cannot open, run the command Fabricator shows, then [report a problem](https://spatney.github.io/rayfin-fabricator/docs/troubleshooting/report-a-problem) if the check still fails.

## A pipeline failed

You see **Deploying your preview** or **Publishing for everyone** fail, or the team menu shows **Last publish** with **View on GitHub**.

The GitHub Actions workflow builds and deploys team apps. Common verified causes include an old Rayfin version and destructive data changes.

1. Open the team menu and select **View logs**, **View on GitHub**, or **View logs on GitHub**.
2. Select **Diagnose with Copilot** next to **View logs**, or in the **Publish** window, to find the likely cause. If the cause is in the app's code, select **Fix with Copilot** to hand the diagnosis to the app's chat.
3. If the log says "Team workspaces need Rayfin 1.36.2 or newer", open the app, select Rayfin in the status bar, choose **Update with Copilot**, then save another change.
4. If the log says "This change would delete data in the published app. Publish it again from Fabricator and confirm to allow it.", return to the app and publish again.
5. If Fabricator offers **Deploy anyway (deletes data)**, select it only if you accept the data deletion.

If the log does not explain the failure, attach the GitHub run URL when you [report a problem](https://spatney.github.io/rayfin-fabricator/docs/troubleshooting/report-a-problem).

## No runner picks up the pipeline

You see one of these:

- Setup stops on **Check that the pipeline can reach Fabric** with "No runner picked up the pipeline's verification run in 6 minutes." or "GitHub didn't start the pipeline's verification run:" followed by GitHub's reason, such as "GitHub Actions hosted runners are disabled for this repository." or "Required runner group '…' not found".
- Setup says "GitHub can't use the pipeline's runner setting: FABRICATOR_RUNS_ON is …", because someone set the variable by hand to a value GitHub can't use.
- Publishing says "Fabricator didn't publish because GitHub didn't start the team pipeline for your preview" or "Your changes are published, but GitHub didn't start the pipeline that deploys them".
- A preview or publish shows "Still waiting for a runner".

GitHub Actions runs the pipeline on runners. Your GitHub organization or enterprise may have turned off GitHub-hosted runners, or the runners the pipeline asks for are busy, offline, or not available to the workspace's repository.

1. Find out which runners your organization uses for GitHub Actions. Select **Copy instructions for your admin** if Fabricator shows it, and send the text to a GitHub organization owner.
2. Choose those runners:
   - During setup, choose them under **Where the pipeline runs** in the setup window, then select **Retry**.
   - For an existing workspace, an owner opens the workspace overview, selects **Manage** → **Settings**, and in **Where the pipeline runs** selects **Change**, chooses the runners, and selects **Save**. Then, in **Pipeline health**, select **Repair** or **Check the pipeline**.
3. If Fabricator says "The pipeline's runner couldn't reach GitHub's sign-in, Microsoft Entra ID or Fabric.", ask whoever manages the runners to allow outbound access to GitHub, `login.microsoftonline.com`, and `api.fabric.microsoft.com`.

A repository that belongs to your personal account has no runner groups. If your enterprise allows it, you can add a self-hosted runner to the repository on GitHub, in the repository's **Settings → Actions → Runners**, on a Linux computer. Then choose **Runners with labels** with `self-hosted, linux`.

Runs that were already waiting keep their old runners. Start them again by saving another change or publishing again. See [Where the workflow runs](https://spatney.github.io/rayfin-fabricator/docs/team/administrators#where-the-workflow-runs) for what the runners need. If it still fails, select **Diagnose with Copilot**, then [report a problem](https://spatney.github.io/rayfin-fabricator/docs/troubleshooting/report-a-problem).

## Publish is blocked or has conflicts

You see "Your teammates changed some of the same files as you. Bring in their changes and resolve the conflicts first." You may also see **Let Copilot combine them** or **Ask Copilot to finish**.

This happens when your branch cannot merge the published app cleanly.

1. Open the team menu.
2. Select **Bring in their changes** if it is available.
3. If conflicts remain, select **Let Copilot combine them** or **Ask Copilot to finish**.
4. Review the result in your preview.
5. Select **Publish** again.

If Copilot cannot resolve the conflict, include the conflicted file names when you [report a problem](https://spatney.github.io/rayfin-fabricator/docs/troubleshooting/report-a-problem).

## Previews are not deploying

You see your local preview, but **My preview** stays missing, failed, or older than your latest save. The preview pane may keep showing **Deploying your first preview**.

Team previews are deployed by the repository's GitHub Actions workflow. They do not deploy from your computer.

1. Open the workspace overview.
2. Select your working copy.
3. In **Preview**, use **Watch on GitHub**, **See why it failed**, or **Diagnose with Copilot** if shown.
4. Open **Manage → Settings** and check **Pipeline health** if runs are not starting. If they wait for a runner, see [No runner picks up the pipeline](#no-runner-picks-up-the-pipeline).
5. Select **Repair** if Fabricator says the pipeline needs repair.

If the workflow did not start, check that GitHub Actions is enabled for the repository, then [report a problem](https://spatney.github.io/rayfin-fabricator/docs/troubleshooting/report-a-problem).

## Invitations are not showing

You expect an invitation, but **Invitations** says "No pending invitations. Ask the workspace’s owner to invite your GitHub username."

Fabricator lists pending invitations only for repositories that look like Fabricator team workspaces.

1. Ask the owner to verify the GitHub username.
2. Ask the owner to resend the invitation from **Members** with **Send invitation**.
3. Make sure you are signed in to `gh` as that GitHub user on `github.com`.
4. In **Join a team workspace**, use **Or enter its GitHub repository** and enter `owner/repository` if you already have access.
5. If joining shows an error, select **Diagnose with Copilot** under it.

If you still cannot join, include the repository name when you [report a problem](https://spatney.github.io/rayfin-fabricator/docs/troubleshooting/report-a-problem).

## Repair is needed after updates

You see **Repair** in **Manage → Settings → Pipeline health**, or a local preview error starts with "Couldn't read the deployment's settings:" and tells you to sign in to Fabric or repair the pipeline.

Fabricator updates the managed workflow over time. Existing workspaces can need the newer template or refreshed settings.

1. Open the workspace overview.
2. Select **Manage**.
3. Select **Settings**.
4. In **Pipeline health**, select **Repair**.
5. Wait for the repair checklist to finish.
6. Save a change or publish again.

If repair fails, select **Diagnose with Copilot** in **Pipeline health**. If it still fails, copy the shown problem and [report a problem](https://spatney.github.io/rayfin-fabricator/docs/troubleshooting/report-a-problem).