Locate the failure before changing settings
A user enters a password, approves MFA, and still receives a denial. This does not automatically mean the password is wrong. Separate identity verification, resource access conditions, and permissions inside the application.
This guide provides a focused workflow for Microsoft Entra ID and Microsoft 365. Examples are fictional. Commands read information; none disables an account, policy, or protection. A successful Entra sign-in does not guarantee that the application will authorize every subsequent operation.
Capture a reproducible incident
Record the expected account and tenant, application, requested resource, client, operating system, network, and exact time with time zone. Preserve the AADSTS code, Request ID, and Correlation ID from error details when available. Never request a password, MFA code, or token.
Identify whether the issue affects one person, device, application, or many users. Check Microsoft 365 service health for a broad incident. Make one controlled attempt after collecting details; repeated attempts can complicate logs and lockout behaviour.
Compare with a known authorized combination: the same user on a working managed device, or the same application with an approved test account. Private browsing changes session context; its outcome alone does not prove a cache problem.
Access logs with the appropriate permissions
In Entra ID > Monitoring & health > Sign-in logs, use a suitable read role such as Reports Reader. Conditional Access details can require additional privileges. Do not assign Global Administrator solely to inspect a failed sign-in.
Native sign-in log retention is seven days with Free and 30 days with P1/P2. Search previously configured export destinations for older history. Enabling exports now does not recreate expired events.
Downloading sign-ins through Microsoft Graph requires Entra ID P1 or P2. Conditional Access requires appropriate licensing, generally P1; risk-based capabilities can require P2. Check entitlements for affected users rather than only the administrator.
Find the relevant attempt
Filter by user and a narrow time window, then inspect application and resource. Check the time zone displayed by the interface; use UTC in exports and commands. Match identifiers with time instead of selecting the most recent red row.
Review interactive and non-interactive sign-ins in their respective views. Background token refresh can fail while an interactive sign-in succeeds. For automation, inspect the relevant service principal or managed identity views as well.
Open basic details, Authentication Details, Device Info, and Conditional Access. Preserve the final outcome and intermediate steps: an interruption requiring user action is not necessarily a terminal failure. Ingestion can be delayed; repeat the search after a reasonable interval and record collection time.
Treat error codes as diagnostic leads
50057: disabled account. 50126: credential validation failed. 50076: multifactor authentication required. 53000: noncompliant device. 53003: Conditional Access block. Read Failure reason and Additional details as well; do not turn this list into automated remediation.
A 53003 does not necessarily mean a misconfigured policy: the denial can be intentional. A 50076 can represent an interaction that still needs completion. Check Microsoft’s current code description and the full sequence before changing anything.
MFA succeeded, but access was denied
Inspect each applied policy, its scope, and the unmet control: compliance, device type, authentication strength, or client application. Successful MFA does not automatically satisfy other requirements.
A Report-only policy does not itself deny access. Separate its results from enabled policies. Use What If to understand assignments, then validate a real attempt: simulation does not replace the context actually supplied by the client.
Fictional example: Alice can access SharePoint on her managed laptop but fails in a browser that does not provide the expected device identity. Compare both events and their Device IDs before excluding Alice from the policy.
Check account, method, and application
Confirm the correct tenant and account type, especially for guests. Check enabled state, application assignment, relevant groups, and workload licensing. Missing entitlement can explain a service denial after successful authentication.
For hybrid identities, identify the method actually used: password hash synchronization, pass-through authentication, or federation. Check the health of the involved component. A cloud password reset is not a universal fix for an on-premises directory issue.
For MFA, inspect the requested method and what actually satisfied authentication. New registration must follow the organization’s identity-verification procedure. Do not delete all methods at the request of an unverified person.
Inspect Windows device state
Run dsregcmd /status in the affected user’s session. Inspect AzureAdJoined, DomainJoined, DeviceId, and AzureAdPrt against the intended architecture. Compare DeviceId with the sign-in record.
A joined device is not necessarily compliant. Separately inspect Entra and Intune state, last synchronization, and noncompliance reasons. A blank log field may also reflect a client that does not supply that information.
Do not start with dsregcmd /leave, machine-account deletion, or device re-enrollment. These changes can affect access, certificates, and recovery. Protect diagnostic output containing internal identifiers.
dsregcmd /statusCollect a bounded window with Graph PowerShell
Use Microsoft.Graph.Reports with approved AuditLog.Read.All consent and a supported role such as Reports Reader. This block uses a fictional user ID and UTC window; -All follows pagination. This v1.0 extraction does not replace every sign-in view in the portal.
appliedConditionalAccessPolicies details can be omitted without the necessary Conditional Access read privileges. Missing details do not prove that no policy applies. Have an authorized reader inspect them rather than adding write permissions.
Preserve raw results in a restricted incident folder if an export is needed. Record filters and errors. Do not publish logs, IP addresses, or identifiers in a public ticket.
# Microsoft.Graph.Reports; read-only, fictional identifiers
Connect-MgGraph -Scopes 'AuditLog.Read.All' -NoWelcome
$uid = '11111111-2222-3333-4444-555555555555'
$filter = "userId eq '$uid' and createdDateTime ge 2026-10-20T12:00:00Z and createdDateTime le 2026-10-20T14:00:00Z"
$events = @(Get-MgAuditLogSignIn -Filter $filter -All -ErrorAction Stop)
$events | Select-Object CreatedDateTime, Id, CorrelationId,
AppDisplayName, ResourceDisplayName, ClientAppUsed,
ConditionalAccessStatus, @{n='ErrorCode';e={$_.Status.ErrorCode}},
@{n='FailureReason';e={$_.Status.FailureReason}},
@{n='DeviceId';e={$_.DeviceDetail.DeviceId}} |
Format-ListCorrect a specific cause and validate
Separate diagnosis from change. Document the supported cause, initial state, owner, pilot scope, expected result, and rollback. Fix an incorrect assignment, failed compliance requirement, or identified application setting; do not globally disable MFA or Conditional Access.
After correction, repeat the authorized scenario and inspect the new event. Also test a scenario that should remain denied using a test account without risking data. Confirm the actual service works, rather than relying only on a Success label.
If an approved temporary exception is essential, constrain its scope, assign an expiry and owner, and monitor its use. Preserve administrative recovery access under the existing procedure. Return to the documented state if the pilot fails to deliver the expected outcome.
When to escalate and what to provide
Escalate when many users are affected, the cause remains unclear, or compromise indicators appear. Supply UTC time, request/correlation identifiers, tenant, application, resource, client, code, policy outcomes, and before/after comparison through an approved channel.
A useful case separates observations from hypotheses. For example, “MFA satisfied, access denied by a compliance requirement, device absent from this attempt’s context” is more actionable than “MFA is broken.” State retention or permission limitations.
Microsoft 365/Entra consulting can help analyze policies and dependencies without disrupting users. This troubleshooting guide complements the Conditional Access and compromised-account guides; it does not replace a full assessment or incident response.
About the author
Marc-Antoine Lambert
Montréal-based senior IT consultant and Team Lead specializing in architecture, cybersecurity, Microsoft infrastructure, networking and business continuity.
Discuss your environment →