Conditional Access troubleshooting with Entra sign-in logs
For identity administrators, Microsoft 365 administrators and senior service desk staff who are asked "why was this person blocked?" or "why didn't the policy apply?". You should already know what Conditional Access policies are and how they are built (the courses Microsoft Entra ID administration and Conditional Access with Intune compliance cover that). This course goes deeper into the evidence: finding the exact sign-in event, reading the Conditional Access and Report-only tabs, explaining a result with policy details, the What If tool and service dependencies, tracing a policy change in the audit log, and fixing or rolling back without locking anyone out. Menus and names follow Microsoft Learn as of 2026; check current documentation because the admin center changes. Ends with a supervisor-graded investigation.
- Level
- Advanced
- Length
- About 95 minutes
- Contents
- 5 lessons · final exam
- Status
- Published · updated 10 Oct 2026
- Microsoft Entra ID
Skills you'll practise
- Locate the sign-in event behind a user's report using correlation ID, request ID, user, time and Conditional Access filters
- Interpret the Conditional Access and Report-only results in a sign-in event to identify which policy blocked or would block access
- Explain why a policy did or didn't apply using policy details, the What If tool and the resource that was actually requested
- Identify the policy change behind a new failure from the audit log's modified properties
- Choose a safe fix or rollback and record the investigation with the identifiers support needs
Course outline
- 1.Locate the sign-in event behind the reportLesson · 18 min
- 2.Interpret Conditional Access and Report-only resultsLesson · 20 min
- 3.Explain why a policy did or didn't applyLesson · 20 min
- 4.Identify the policy change behind a new failureLesson · 15 min
- 5.Choose a safe fix or rollback and record itLesson · 12 min
- 6.Conditional Access troubleshooting with Entra sign-in logs: knowledge checkKnowledge check · 14 questions
- 7.Conditional Access troubleshooting with Entra sign-in logs: practical exerciseKnowledge check · 1 question
- 8.Final exam10 questions · passing it completes the course, so people who already know the material can test out
Sources it draws on
The lessons and questions are written from these references, so learners can go back to the original.
- Microsoft Learn: Troubleshoot sign-in problems with Conditional Access (sign-in log steps, error codes 53000 to 53009, service dependencies, audience reporting, lockout)
- Microsoft Learn: Learn about the sign-in log activity details (who/how/what, identifiers, Conditional Access statuses, time zone and location caveats)
- Microsoft Learn: What are Microsoft Entra sign-in logs? (log types, where to find them, least privileged role)
- Microsoft Learn: Troubleshoot Conditional Access policies with the What If tool
- Microsoft Learn: Analyze Conditional Access policy impact (report-only results)
- Microsoft Learn: Building a Conditional Access policy (all applicable policies must be satisfied; two-phase evaluation)
- Microsoft Learn: Use audit logs to troubleshoot Conditional Access policy changes
- Microsoft Learn: Plan a Conditional Access deployment (testing exclusions, rolling back, information to collect)
- Microsoft Learn: Microsoft Entra data retention (sign-in and audit log retention by licence)
- Microsoft Learn: What is the Sign-in diagnostic in Microsoft Entra ID?
See it with your own jobs and topics
Tell us about your team and we'll walk you through setup, from choosing jobs to your first skills check.