Before you start
Capture the current state, preserve recoverable data and record recent changes before remediation. Use production-impacting commands only within an approved maintenance or change window.
Capture sign-in evidence
Record user, application, client, device, location, timestamp and error code. Inspect Conditional Access evaluation details.
Identify matching policy
Review included and excluded users, groups, apps, locations, platforms and device filters.
Check authentication requirements
Determine whether MFA, authentication strength, compliant device or another grant control is required. Verify the account and device can satisfy it.
Check device and location signals
Validate device registration and compliance. Verify source IP and named-location definitions for location policies.
Remediate safely
Make the smallest policy change that resolves the intended condition. Avoid broad exclusions as a permanent fix. Retest the original sign-in.
Graph sign-in sample
Connect-MgGraph -Scopes 'AuditLog.Read.All'
Get-MgAuditLogSignIn -Top 20 | Select-Object CreatedDateTime,UserDisplayName,AppDisplayName,Status,ConditionalAccessStatusTroubleshooting validation
- Confirm the original symptom is resolved.
- Verify dependent services and application health.
- Review logs or command output for secondary errors.
- Document the root cause and corrective action.
- Retain rollback evidence until the change is accepted.
Frequently Asked Questions
What should I check first?
Capture the current state, exact error, affected scope and recent changes before making changes. Then test the failing layer from the lowest dependency upward.
How do I validate the fix?
Repeat the original failing operation, check dependent services and confirm the issue remains resolved after any required restart or service recovery.
Can this troubleshooting be automated?
Automate read-only diagnostics first. Add remediation only after commands, permissions, logging and rollback behavior have been validated.