Conditional Access evaluates after authentication succeeds. That single fact
resolves most tickets that reach the service desk as "I can't sign in".
A policy is a sentence: if these assignments match, apply these controls.
- Assignments — users and groups, cloud apps, and conditions such as platform,
location, client app, device state and sign-in risk.
- Grant controls — require MFA, require a compliant device, require a hybrid
joined device, require an approved client app, or block outright.
Recognising a policy block
- The failure code is in the 53xxx range (53000, 53003, 530002) or 50097.
- The sign-in log entry names the policy that failed. Read it.
- The user can sign in from a different device or platform. That asymmetry is the
signature: identity is fine, something about the context is not.
If the same account works on a phone and fails on a laptop, stop looking at the
account.
What If
The What If tool answers "which policies apply to this user, on this platform, for
this app, and what would happen". Use it to:
- Confirm which policy is responsible rather than guessing from the name.
- See why another device is unaffected — usually a platform condition.
- Check whether a second policy would block the request even after you fix the first.
Fix the condition, not the policy
The correct resolution is to satisfy the grant control:
| Control | Fix |
|---|---|
| Require compliant device | Make the device compliant — see Intune device compliance |
| Require MFA | Ensure the user has a usable registered method |
| Require approved client app | Use the supported app, or enrol it properly |
| Require hybrid joined device | Resolve the join, not the policy |
| Block (legacy authentication) | Move the client to modern authentication |
**Never exclude a user or device from a Conditional Access policy to close a
ticket.** An exclusion silently removes a security control from a live tenant, and
exclusions are never reviewed. If one is genuinely required it is a change with an
owner, a justification and an expiry date — not a service desk action.
Token lifetime — the step people forget
Fixing the underlying condition does not immediately unblock the user. Tokens issued
before the change carry the old state and keep failing until they are refreshed. Have
the user sign out and back in, and confirm with them directly that the app works.
"The console says compliant" is not a resolution.
Related
- Intune device compliance
- Reading sign-in failure codes (AADSTS)
- Sharing and least privilege