Separate Microsoft cloud identity, Conditional Access, device management, licensing, Azure networking and resource permissions when diagnosing an access problem.
- For a sign-in failure, keep the error code, time, user, correlation identifier and Conditional Access result.
- For Intune, compare the cloud record with local device state, enrollment and the last successful synchronization.
- For an Azure resource, verify the account, tenant, subscription, scope, effective routes and applicable access rules.
Command examples
Adapt placeholders, permissions and target systems before using an example. These examples are documentation; no command runs from this page.
Get-MgUserAuthenticationMethod -UserId <USER_ID>Get-WinEvent -LogName 'Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin' -MaxEvents 50Get-MgDeviceManagementManagedDevice -Top 50Get-MgUserLicenseDetail -UserId <USER_ID>az network nic list-effective-nsg -g <RG> -n <NIC>az network nic show-effective-route-table -g <RG> -n <NIC>az role assignment list --assignee <UPN> --allCheck the affected endpoint
Identify the actual Microsoft service, hostname and required connection before testing connectivity. Reachability alone does not establish authorization.
Collect device and identity state
Correlate the device’s local join and management state with its Entra and Intune records. Use only the monitoring permissions required for the investigation.
Start with sign-in evidence
Match the reported failure to the sign-in event and its policy evaluation rather than changing several identity settings together.
Document emergency access
Maintain, protect and test an emergency-access procedure and monitor its use. Evaluate policy changes against that procedure before deployment.
Evaluate Conditional Access changes
Use policy evaluation and an appropriate test scope before a broad deployment. Preserve the evidence that explains an access decision.
Request the required Graph scopes
Check tenant, account and consent context before querying Graph. Additional scopes should be justified by the operation.
Compare Intune and device evidence
Distinguish registration, enrollment, compliance and configuration reporting. Allow reporting time after a controlled change.
Check the RBAC scope
An Azure role assignment depends on its scope, inheritance and tenant. Establish the intended resource and effective access before changing an assignment.