A Conditional Access policy denies access for the observed sign-in context.
Likely causes
- Non-compliant device
- Disallowed country or IP
- Legacy client
- Risk or targeted application
Checks in priority order
- Open Sign-in logs
- Read the Conditional Access result
- Identify the blocking policy
- Fix the condition instead of disabling the policy
When to escalate
Escalate when the failure affects multiple users, a production dependency is unavailable, or logs show a component outside your control. Include timestamps, scope, tests already performed, and the last known working state.