iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Short answer: Start with the user’s exact failed sign-in, not with a guess about which policy changed. Capture the time, user, application, client, error code and correlation ID; find that event in Entra ID > Monitoring & health > Sign-in logs; read its Conditional Access result and context; compare the policy’s audit-log change; then make the narrowest correction that the evidence supports. Microsoft’s Conditional Access troubleshooting guidance follows this evidence-first approach.
- Preserve the exact error and “More details” text.
- Locate the matching failed sign-in by time, user, resource and correlation ID.
- Inspect applied policies, device, location, authentication and resource details.
- Compare the current policy with its previous version in Audit logs.
- Use Sign-in diagnostics and What If as supporting tools, not substitutes for the real event.
- Correct only the assignment, condition or grant control that caused the failure.
- If every administrator is blocked, follow Microsoft’s support-request recovery path.
Why a policy change can look like a sign-in outage
A Conditional Access failure is not automatically a bad password, a broken authentication service or a tenant-wide outage. Conditional Access evaluates the identity, target resource, client, device, location, risk and other sign-in context. The failed event records which policies were evaluated and what result they produced. That event is the authoritative starting point for troubleshooting.
Some applications request more than one resource during a single sign-in. A user may think they are opening one application while the flow also requests a dependent resource. Conditional Access can therefore block a resource the user did not recognize. The event’s resource or audience and its service-dependency details are essential when the named application and the blocking policy seem unrelated. See Microsoft’s Conditional Access troubleshooting documentation for the dependency caveat.
1. Capture the failure before changing anything
Ask the affected person to reproduce the problem once, if doing so is safe, and preserve the original error page. Do not rely on a paraphrase such as “Entra is rejecting me.” Record:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- The user principal name or other exact account identifier.
- The approximate time, including the time zone.
- The operating system and device type.
- The target application or service and whether the client was a browser or native application.
- The complete error code and every line under More details.
- The correlation ID or request ID shown on the error page, if present.
Keep the error text unchanged in the ticket. The timestamp and identifiers let an administrator distinguish the user’s event from retries, token refreshes and unrelated failures. Microsoft’s Conditional Access deployment planning guidance also recommends collecting this kind of sign-in context when investigating access problems.
2. Find the matching sign-in event
In the Microsoft Entra admin center, open Entra ID > Monitoring & health > Sign-in logs. Set the time range around the reported failure, then narrow the list by the user, target resource, Conditional Access status and correlation ID where that filter is available. Open the failed event that matches the timestamp and identifiers; do not infer a tenant-wide problem from the user’s description alone.
If several events are close together, compare the client, IP or location, resource and request identifiers with the ticket. A user may generate separate events for a password attempt, a token exchange and an application resource. The event that contains the access denial is the one to analyze.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsAccess to applied-policy details depends on permissions. Microsoft’s activity-log guidance explains that an administrator needs access to both the logs and the policies. If the Conditional Access information is missing, check the account’s assigned Entra role and log-reading permissions before concluding that no policy was involved. See Conditional Access and Microsoft Entra activity logs.
3. Read the event in context
Start with the Conditional Access tab
Open the event’s Conditional Access tab. It shows the policies evaluated for that sign-in and the result for each one. Open the policy details to see why a policy applied or why its conditions were not met. A policy can be present in the tenant yet be irrelevant to this event because the user, resource, client, location or other condition did not match.
Check the surrounding event panels
Use the event’s other panels to validate the conditions that the policy saw:
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Event area | What to verify | Why it matters |
|---|---|---|
| Troubleshooting and support | Diagnostic messages, request identifiers and any recommended investigation. | These details can connect the denial to a specific policy condition or service dependency. |
| Device information | Whether the device is registered, joined, compliant or otherwise recognized as required by the policy. | A device requirement can fail even when the user’s credentials are correct. |
| Location | The location or network context detected for the event. | A named-location or location-based condition may differ from the user’s physical description. |
| Authentication details | Methods attempted, authentication strength and any proof-up or risk requirement. | The grant control may require an authentication method the flow did not satisfy. |
| Additional details | Client type, resource or audience, request ID, correlation ID and related context. | These values distinguish the failing resource from a similarly named application and help escalation. |
Use the error code as a clue, not a verdict
Microsoft lists these common Conditional Access-related codes. The code narrows the search; the applied-policy result and event context establish what actually happened.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Code | Microsoft’s listed indication | Next investigation |
|---|---|---|
| 53000 | Device is not compliant. | Check the device information and the policy’s compliance requirement, then verify that the device can reach the management service and complete enrollment or remediation. |
| 53001 | Device is not domain joined. | Confirm the join state shown in the event and whether the policy requires a joined device for this resource and client. |
| 53002 | Application is not an approved app. | Identify the client recorded in the event and compare it with the policy’s approved-client requirement. |
| 53003 | Blocked by Conditional Access. | Open the Conditional Access tab and identify the policy whose block or unmet grant control produced the denial. |
| 53004 | Proof-up is blocked because of risk. | Review the risk and authentication details, and determine whether the policy requires an action the user cannot complete in this flow. |
| 53009 | Application needs to enforce Intune protection policies. | Check the application, client and protection-policy requirements recorded for the event. |
For the complete error-investigation context, see Microsoft’s sign-in error troubleshooting guidance and the Conditional Access troubleshooting article.
Resolve apparent application mismatches
If the user opened one application but the event names another resource, inspect the resource or audience and the service-dependency information before editing policy assignments. A dependent resource can be the component that actually failed. What looks like an incorrect application assignment may be a normal multi-resource sign-in flow.
4. Compare the policy change in Audit logs
After identifying the real failed event, determine what changed at the time failures began:
- Open Entra ID > Monitoring & health > Audit logs.
- Filter for the Conditional Access service and policy-related activity.
- Set the time range to include the last known successful sign-in and the first failure.
- Open policy update entries that match the suspected policy.
- Inspect Modified properties. Microsoft documents that these properties can be used to compare the current policy with its previous version.
- Compare assignments, included and excluded users or resources, conditions and grant controls with the failed event’s context.
Correlate the audit entry’s change time with the user’s first failure. A policy updated after the failure cannot explain that event, while a change immediately before a cluster of matching failures is a strong lead that still needs confirmation in the sign-in record. The procedures and permission considerations are described in Microsoft Entra activity-log guidance.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 115. Use What If and Sign-in diagnostics for the questions they can answer
These tools support the event investigation but do not replace it. Choose the tool according to the question you need to answer.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Tool or path | Best use | Important limitation |
|---|---|---|
| Sign-in log and event details | Establish what happened in the real failure, including applied policies, result and sign-in context. | You must locate the correct event and have permission to read the logs and policies. |
| What If simulation | Estimate which enabled or report-only policies apply to a selected identity, resource and set of conditions. | It does not evaluate Conditional Access service dependencies, so it is not a replay of the actual sign-in. |
| Sign-in diagnostics | Analyze a sign-in or flagged sign-in and receive recommendations for the next investigation step. | Follow the recommendation, then verify it against the event and policy details. |
Run a What If simulation
Open Microsoft’s Conditional Access What If tool and select the identity, resource and conditions that resemble the failed event. Include the client, location, device state and risk inputs that are relevant to the policy. Review both enabled and report-only policies in the result. If the simulation appears to allow access while the real event was denied, check service dependencies and the event’s actual resource rather than treating the simulation as proof that the policy is harmless.
Run Sign-in diagnostics
Use Microsoft Entra Sign-in diagnostics to analyze the identified event or a flagged event. Apply its recommended path to the policy, condition or service involved, then return to the original event to confirm that the recommendation explains the recorded result. Diagnostics are particularly useful when the Conditional Access tab does not make the cause obvious, but they do not remove the need to validate the real event.
6. Apply the narrowest supported correction
Use the event and the before-and-after policy comparison to decide which part of the policy needs correction. Avoid disabling unrelated controls or creating a broad emergency exclusion when a smaller change addresses the failing condition.
Free tools Windows power users keep installed
One-click scans. No signup required.
Correct an assignment when scope is wrong
If the event shows that the wrong users, groups, applications or resources were included, adjust only that assignment. Check exclusions as well as inclusions: an exclusion that was removed or a resource that was newly added can explain an otherwise unchanged policy result. Recheck the event’s resource or audience before changing an application assignment.
Correct a condition when context is misclassified
If the policy should apply only to a particular location, client, device state or risk level, compare that condition with what the event recorded. Correct the condition or the underlying directory, device-management or named-location data that is wrong. Do not weaken the policy merely because the user’s description conflicts with the event; investigate the recorded context first.
Correct a grant control when the requirement cannot be met
A grant control can demand device compliance, a joined device, an approved client, an authentication method or an Intune protection state. Verify that the requirement is achievable for the affected user and client. Microsoft cautions against requirements users cannot meet, such as requiring compliance before devices can enroll. If the control is appropriate but the user has not completed the required step, provide that remediation path rather than removing the control.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Validate the correction
After making the smallest supported change, have the user retry once with the same client and resource. Locate the new sign-in event and confirm that the previously failing policy now has the intended result. Check that another policy or dependent resource did not become the next blocker. Record the policy change, test time, event correlation ID and outcome in the incident.
Recommended Free Tools
What to do if a Conditional Access policy locked out every administrator
- Check whether any administrator still has access, including an administrator using a different account, client or approved recovery path.
- If another administrator can sign in, open the affected policy and disable or correct it, then verify the change with a new sign-in event.
- If no administrator can update the policy, submit a Microsoft support request and provide the tenant details, policy name, policy-change time, failed-event request or correlation ID, and the exact dates and times of the lockout.
Microsoft’s Conditional Access troubleshooting documentation states: "If no admin in your organization can update the policy, submit a support request. Microsoft support reviews and, after confirming, updates the Conditional Access policies that prevent access."
Do not attempt to solve a complete lockout by guessing at policy edits from outside the tenant. The support route is the documented recovery path when no administrator can change the configuration.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep an emergency access path available
Recovery accounts should be prepared before a policy incident. Microsoft’s emergency-access account guidance recommends:
- Maintain at least two emergency-access accounts.
- Use cloud-only accounts that do not depend on a federated identity provider.
- Exclude those accounts from Conditional Access policies that block or restrict sign-in, while monitoring their activity carefully.
- Validate that the accounts work at least every 90 days.
- Use phishing-resistant authentication options such as FIDO2 security keys or certificate-based authentication where appropriate.
These accounts are a controlled recovery mechanism, not a workaround for ordinary users. Document who can use them, monitor every sign-in and test them on the stated schedule. A recovery account that has never been tested is not a dependable recovery path.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Common symptom-to-check branches
The user can authenticate but the device is rejected
Open Device information and compare the recorded compliance or join state with the grant control. If the device is not enrolled, joined or compliant, follow the organization’s enrollment or remediation process. If the event says the device should qualify, investigate stale device registration or management data before changing the policy.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
A browser works but a native client is blocked
Compare the client type and application details in the successful and failed events. An approved-client or protection-policy requirement may apply differently to the native client. Correct the client assignment or have the user use a supported client only when that is the intended policy outcome.
Only one resource in an application workflow fails
Compare the resource or audience in each event and inspect service dependencies. The initial application may be allowed while a dependent resource is blocked. Change the policy that actually evaluated that resource, not a similarly named application that was merely the entry point.
Many users fail immediately after one policy edit
Use Audit logs to identify the update and Modified properties to compare versions. Then sample a failed event from each affected client or resource. A single broad assignment or unmet grant requirement can produce several different error presentations, so confirm the common policy result before rolling back unrelated changes.
Prepare a complete escalation package
If the event remains unexplained, send the next administrator or Microsoft support a concise evidence bundle:
- User principal name, tenant identifier and target resource.
- Exact failure time with time zone and the last known successful time.
- Correlation ID, request ID and complete error text.
- Client, operating system, device state, location and authentication details from the event.
- Conditional Access tab results and the names of policies shown there.
- Relevant Audit-log entry, including the policy update time and Modified properties.
- Any Sign-in diagnostics recommendation and What If inputs and result.
- The correction already attempted and the correlation ID of the verification event.
This package lets the next investigator reproduce the reasoning from the real sign-in, rather than restarting with a broad search through every policy.
Quick Recap
Reference documentation
- Troubleshooting sign-in problems with Conditional Access
- The Conditional Access What If tool
- Plan Your Microsoft Entra Conditional Access Deployment
- Conditional Access and Microsoft Entra activity logs
- How to troubleshoot sign-in errors
- How to use Microsoft Entra Sign-in diagnostics
- Manage emergency access admin accounts
- Conditional Access block policy health scenario
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
