When a connection will not connect

The five things that break an authorisation, in the order they break.

A connection fails in a small number of ways, and they look similar from the outside. This is the order to check them in.

The redirect URL does not match, character for character
The most common failure by a distance. A trailing slash, www, http instead of https, or a different path all count as different URLs. Providers reject the exchange with a message that says the URI is invalid and not which character is wrong.
The account you authorised with cannot grant what was asked
Some scopes need an administrator. The consent screen appears, the person clicks through, and the exchange fails or comes back with fewer scopes than requested. Authorise with an account that administers the organisation.
The provider needs someone to approve the application first
Several providers gate production access behind a review. Until it clears, the application often works for a small number of nominated test accounts and for nobody else — which reads as an intermittent fault rather than as a pending approval.
The verification call failed even though authorisation succeeded
Authorisation and verification are separate. A connection is not verified until one harmless read has come back. If authorisation succeeded and the connection is not verified, the token exists and does not have the access it needs.
The workspace never selected the connection
A provider is authorised against your account, and a workspace then selects it. Both steps are required. An agent that cannot see a system it was briefed on is usually looking at a workspace that has not selected the connection.

The five things that break an authorisation, in the order they break.

A connection fails in a small number of ways, and they look similar from the outside. This is the order to check them in.

The redirect URL does not match, character for character
The most common failure by a distance. A trailing slash, www, http instead of https, or a different path all count as different URLs. Providers reject the exchange with a message that says the URI is invalid and not which character is wrong.
The account you authorised with cannot grant what was asked
Some scopes need an administrator. The consent screen appears, the person clicks through, and the exchange fails or comes back with fewer scopes than requested. Authorise with an account that administers the organisation.
The provider needs someone to approve the application first
Several providers gate production access behind a review. Until it clears, the application often works for a small number of nominated test accounts and for nobody else — which reads as an intermittent fault rather than as a pending approval.
The verification call failed even though authorisation succeeded
Authorisation and verification are separate. A connection is not verified until one harmless read has come back. If authorisation succeeded and the connection is not verified, the token exists and does not have the access it needs.
The workspace never selected the connection
A provider is authorised against your account, and a workspace then selects it. Both steps are required. An agent that cannot see a system it was briefed on is usually looking at a workspace that has not selected the connection.