> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# FAQ

> Frequently asked questions across setup, devices, integrations, security, and billing

Common questions that come up repeatedly in onboarding, support, and evaluation. Grouped by topic. If you don't see your question here, check [Troubleshooting](/reference/troubleshooting) for symptom-driven answers or [Glossary](/reference/glossary) for terminology.

## Setup

<AccordionGroup>
  <Accordion title="How do I sign up for ThreatAware Protect?">
    There is no self-service signup. Protect is provisioned by the ThreatAware account team. Get in touch via [threataware.com](https://threataware.com) or your security partner — see [Onboarding](/onboarding).
  </Accordion>

  <Accordion title="What's my Cloud ID?">
    Your tenant's unique subdomain on `*.threataware.com` (e.g. `https://acme.threataware.com`). Provided in your welcome email at provisioning.
  </Accordion>

  <Accordion title="How long does initial setup take?">
    Connecting one OAuth integration (e.g. Microsoft Entra ID) takes about five minutes. A full first-day setup — identity + EDR + MDM + on-prem AD — usually takes 30-60 minutes plus first-sync wait time. See [Onboarding](/onboarding) for the step-by-step.
  </Accordion>

  <Accordion title="Do I need to install agents on endpoints?">
    No. Protect is 100% API-based. The only optional install is the [PowerShell Relay](/powershell-relay) — a small Windows service that lets Protect query on-premises tools without inbound firewall rules.
  </Accordion>

  <Accordion title="Which integration should I connect first?">
    Microsoft Entra ID if you're a Microsoft shop — it's OAuth, fast, and gives you cloud-device discovery plus identity in one step. Otherwise your primary EDR. See [Onboarding](/onboarding) for the recommended order.
  </Accordion>

  <Accordion title="How long does the first sync take?">
    Typically 15-60 minutes depending on estate size. Live integration cards show "Last synced N minutes ago" on the [Settings → Integrations](/settings/integrations) page.
  </Accordion>
</AccordionGroup>

## Devices

<AccordionGroup>
  <Accordion title="Why does my device count differ from [other tool]?">
    Three usual causes:

    1. Protect deduplicates across tools (right answer; the total will look lower than the sum of all tool counts)
    2. Active vs. Inactive filter (Protect defaults to Active — devices not seen within the **Inactive device threshold** are hidden)
    3. The other tool counts archived / deleted devices that Protect filters out

    Use [X-Ray](/x-ray) on a specific device to see exactly which tools see it.
  </Accordion>

  <Accordion title="What's the difference between Active and Inactive?">
    A device is **Active** if at least one connected source has seen it within the **Inactive device threshold** (default 30 days, configurable in [Settings → Misc](/settings/misc)). Beyond that threshold it becomes **Inactive** and is hidden from default views, dashboard counts, and Vitals calculations.
  </Accordion>

  <Accordion title="Can I delete a device?">
    No — and that's intentional. Protect reflects reality from your tools. If a device should be gone, decommission it in the source tool; it'll drop out of Protect within the [Inactive threshold](/settings/misc). You can also configure a **Device retention policy** to clean up records that have been removed from all source tools.
  </Accordion>

  <Accordion title="The same device appears twice — why?">
    The matching algorithm couldn't fuse the records. Open [X-Ray](/x-ray) on each row — if no integration overlaps, they're genuinely different devices. If they overlap, contact support. See [Troubleshooting → Devices](/reference/troubleshooting#devices).
  </Accordion>

  <Accordion title="Why is a device's location wrong?">
    Geolocation comes from public IP. VPN egress or NAT'd IPs often geolocate to the wrong country. Configure overrides in [Settings → IP Locations](/settings/ip-locations).
  </Accordion>

  <Accordion title="What's a Stealth Device?">
    A device detected by network-scanning integrations (Lansweeper, Qualys, etc.) that isn't visible in any of your management tools. See [Stealth Devices](/stealth-devices) and the [Network Inventory](/network-inventory) page.
  </Accordion>
</AccordionGroup>

## Integrations

<AccordionGroup>
  <Accordion title="How often does data refresh?">
    Hourly from every integration as a default cadence. Processing adds 5-30 minutes after each sync. To force a sync immediately, go to [Settings → Integrations](/settings/integrations) → click the integration → Sync Now.
  </Accordion>

  <Accordion title="Can I integrate with a tool that's not in the list?">
    Possibly — contact your account manager with the vendor name and their API documentation. Typical turnaround for a new integration is a few weeks.
  </Accordion>

  <Accordion title="My integration card says DISCONNECTED — what now?">
    Credentials have been revoked or expired. Open the card → Modify → re-enter credentials or re-run the OAuth flow. See [Troubleshooting → Integrations](/reference/troubleshooting#integrations).
  </Accordion>

  <Accordion title="Why does the same integration appear multiple times?">
    You have multiple tenants of the same vendor tool (e.g. two Entra ID directories). Enable **Multi-Tenant** on the integration so devices match across tenants — see [Multi-Tenancy](/multi-tenancy).
  </Accordion>

  <Accordion title="Do I need PowerShell Relay?">
    Only for **on-premises** tools that aren't exposed to the internet — typically Active Directory, SCCM, and similar. Cloud SaaS integrations connect directly. See [PowerShell Relay](/powershell-relay).
  </Accordion>

  <Accordion title="What permissions does Protect need on my Microsoft tenant?">
    Read scopes only — Protect never writes back to the source tools through its integrations. See the [Microsoft Graph Required Permissions](/connection-guides/microsoft-graphapi-required-permissions) guide for the exact scope list.
  </Accordion>
</AccordionGroup>

## Security & access

<AccordionGroup>
  <Accordion title="Is ThreatAware Protect read-only against my tools?">
    The Protect platform reads from your tools through API integrations. **Actions** can write to downstream systems you opt in to (e.g. open a ServiceNow ticket, post to Teams, call a custom webhook), but those are explicit outbound automations you configure. See [Trust & Security](/trust/security).
  </Accordion>

  <Accordion title="What certifications do you hold?">
    ISO 27001 and Cyber Essentials. Full details in [Trust → Certifications](/trust/certifications).
  </Accordion>

  <Accordion title="How is access controlled?">
    Four default roles (Super Admin, Analyst, Viewer, Limited Viewer), plus custom roles, plus per-user data filters and field-level hiding. See [Access Control](/access-control) and [Role Permissions](/reference/role-permissions).
  </Accordion>

  <Accordion title="Does Protect support SSO?">
    Yes — Microsoft Entra ID (self-service), Okta (manual setup), and generic SAML / OIDC. See [Access Control](/access-control).
  </Accordion>

  <Accordion title="Can I restrict who sees the audit log?">
    Yes. The Audit Log permission is role-gated — Analysts see their own entries by default; Viewer and Limited Viewer see nothing. Configure in [Settings → Roles](/settings/roles). See [Audit Log Events](/reference/audit-log-events) for what's recorded.
  </Accordion>

  <Accordion title="Where is my data stored?">
    See [Trust → Architecture](/trust/architecture) for the hosting and data-residency picture.
  </Accordion>

  <Accordion title="What's a silent failure and why should I care?">
    An EDR or security agent that's deployed and looks healthy in its own console but has stopped reporting. Protect detects these via cross-tool correlation. See [Silent Failure](/silent-failure).
  </Accordion>
</AccordionGroup>

## Billing & licensing

<AccordionGroup>
  <Accordion title="How is ThreatAware Protect priced?">
    Pricing is per-tenant and varies with scale and tier. Speak to your account team — there's no public price list.
  </Accordion>

  <Accordion title="Is there a free trial?">
    Evaluation access is arranged through the account team rather than self-service. See [Quickstart](/quickstart).
  </Accordion>

  <Accordion title="What counts as a device for licensing?">
    A unified device record in the Devices grid after deduplication. Five integrations all reporting the same laptop count as one device.
  </Accordion>
</AccordionGroup>

## Cross-references

<CardGroup cols={3}>
  <Card title="Troubleshooting" icon="screwdriver-wrench" href="/reference/troubleshooting">
    Symptom-driven fixes
  </Card>

  <Card title="Glossary" icon="book-bookmark" href="/reference/glossary">
    A-Z terms
  </Card>

  <Card title="Onboarding" icon="rocket" href="/onboarding">
    First-day setup
  </Card>

  <Card title="Trust & Security" icon="shield-check" href="/trust/security">
    Architecture, certifications, data handling
  </Card>

  <Card title="Support" icon="life-ring" href="mailto:help@threataware.com">
    When the docs don't have it
  </Card>
</CardGroup>