Identify the exact Conditional Access policy blocking a sign-in without creating a broad exclusion.
Before you start
Work on a copy or a controlled test when the change can affect production. Keep timestamps, screenshots and the previous configuration so the result can be compared.
Step by step
- Open the user Sign-in logs and select the matching failure.
- Read the Conditional Access tab and identify applied policies.
- Check location, device, risk level, client, and target application.
- Fix the compliance or condition causing the block.
- Use only a minimal, temporary, documented exclusion when justified.
Validation
Repeat the original test after the change and confirm that the expected service works without creating a new regression. Document the final state.