Troubleshooting

Cloud Proxy onboarding has two paths: self-install (the user signs in) and MDM (a generated .mobileconfig carries the org token). Most issues come from one of three places: the sign-in or profile never completed, the device is not routing traffic through the agent, or the sessions are landing somewhere you are not looking.

Self-install: sign-in problems

The self-install flow opens a browser prompt the user must approve.

Check:

1. The user launched the agent after installing it. The sign-in prompt only appears once the agent starts.
2. The user signed in with their work email, the one their Flowstate account uses. A personal email will not attribute sessions to them.
3. The browser completed the approval. If the prompt was dismissed, restart the agent to trigger it again.
4. The device can reach proxy.flowstate.inc on port 443. A corporate proxy or SWG that blocks it breaks the flow. See corporate proxies.

MDM: profile deployment checks

Check:

1. The profile was generated from Settings → AI → Cloud Proxy and deployed alongside the agent package.
2. The profile actually landed on the device. On macOS: System Settings → General → Device Management.
3. Your MDM expands the $EMAIL placeholder. A literal $EMAIL on the device means the MDM did not substitute the enrolled user's email, and sessions will not attribute.
4. The embedded org token is current. If the token was rotated after you deployed, redeploy a freshly generated profile. See Key rotation.

Sessions not appearing

Sessions appear under Insights → Agent insights → Agent sessions (/plan/main/insights/agents/sessions), not on the Settings page. Individuals see their own sessions at My AI → My sessions.

If sessions still do not appear a few minutes after using an AI tool:

• Confirm the agent is running on the device. See the per-OS checks in macOS, Windows, and Linux.
• Check whether the tool bypasses the system proxy. The agent only captures traffic it can see; PAC mode covers tools that honour the system proxy.
• A 401 from the cloud proxy means a wrong or revoked credential. Redeploy the current profile, or have the user sign in again on a self-install device.
• See the full agent troubleshooting triage flow.

A custom provider endpoint is not captured

The proxy always covers standard provider hosts. If your organisation calls a private or custom endpoint (a custom Azure OpenAI endpoint, a private host), add its hostname under Custom AI-service hostnames on Settings → AI → Cloud Proxy. Changes reach the fleet within about 5 minutes.

Deeper governance data

The proxy attributes sessions and spend. For richer data:

• install the Flowstate Agent everywhere you want endpoint capture;
• connect Usage providers for authoritative provider spend;
• use Telemetry vs Enterprise to decide whether prompt bodies are captured.

Rotating the org token

There is no rotate button on the Cloud Proxy page. Follow the runbook at Key rotation.

Getting help

Open a support ticket with:

• the affected organisation;
• the rollout path (self-install or MDM) and, for MDM, the vendor;
• whether the profile shows as installed on the device;
• what Insights → Agent insights → Agent sessions shows for the affected user.