What is your provider ?¶
Check its configuration. Make sure you put the proxy in debug mode (log_level in /etc/foreman-proxy/settings.yml). Pull the command from the log and try it manually, what happens? Make sure to run it as the foreman-proxy user.
You can find more detailed instructions in the Puppet run providers section of the manual
For MCO provider¶
As of 1.7.1, you will need to add a custom entry in the sudoers file: /usr/bin/mco puppet runonce -I * ( after the NOPASSWD : )