The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →If Microsoft 365 says your organization blocked sign-in or your device does not meet its security requirements, capture the exact error and have an administrator find the matching Microsoft Entra sign-in event before changing anything. That event shows which policy applied and which requirement was not met. Treat a policy block as an intentional security control until the evidence identifies the cause.
Start with the failed sign-in event
Before retrying, record the exact message and any full AADSTS error code. Note the time, username, app or resource, client type (browser, desktop, mobile, or older mail client), and any request or correlation ID. If the browser error page has a More Details view, capture that information too. Microsoft recommends using the error and Entra logs to investigate unexpected Conditional Access outcomes (Microsoft Conditional Access troubleshooting; Microsoft sign-in error troubleshooting).
As an Amazon Associate I earn from qualifying purchases.
- Administrator: In the Microsoft Entra admin center, go to Entra ID > Monitoring & health > Sign-in logs. If the menu has changed, search the admin center for “Sign-in logs.” A Reports Reader role or higher is needed to view the logs.
- Filter by the affected user, time, application or resource, and failure status. Open the matching event and compare its error code, failure reason, additional details, and correlation ID with the information captured from the user.
- Open the event’s Conditional Access tab. Check which policies applied and whether each requirement was satisfied. Review the event’s device, location, authentication, and additional details alongside the named policy’s assignments, conditions, and grant controls.
- Check both the visible app and the event’s resource or audience. A Teams sign-in, for example, can request Exchange or SharePoint resources too; a policy applied to one of those resources may explain why the Teams attempt failed.
Users can review their own sign-in activity at mysignins.microsoft.com, but an administrator must inspect tenant policies. Conditional Access evaluates policies when a sign-in matches their configured conditions, so a code alone does not identify the policy or establish the right fix.
Match the remedy to the unmet requirement
Once the event identifies the failed control, fix that control rather than reinstalling Office or weakening unrelated security settings.
#1 Best Overall
- The Microsoft Office 365 Bible: The Most Updated and Complete Guide to Excel, Word, PowerPoint, Outlook, OneNote, OneDrive, Teams, Access, and Publisher from Beginners to Advanced
- ABIS BOOK
| What the event shows | What to check or do |
|---|---|
| Device compliance is required but not met | Confirm that the device is enrolled in the organization’s device-management system and currently reports compliant there. Office reinstallation does not by itself change device compliance. |
| A required domain-join condition is not met | Ask IT to confirm the device’s join state and whether the policy’s domain-join requirement is intended for this account and device. |
| MFA is required or setup is incomplete | Complete the organization’s MFA registration and the sign-in prompt. Do not try to bypass the prompt. |
| An approved app or Intune app-protection requirement is unmet | Use an organization-approved, supported client. Ask IT to check the applicable app-protection configuration and whether the client meets it. |
| The sign-in uses legacy authentication or device-code flow | When available, use a supported modern sign-in flow. Ask the administrator whether the restriction is expected before changing tenant settings. |
| Sign-in risk, external access, or MFA registration is involved | Use the event’s diagnostic context to identify whether the remedy belongs in the policy, identity configuration, device management, or client app. |
Microsoft’s Conditional Access guidance documents the relevant controls and troubleshooting process (Conditional Access sign-in troubleshooting).
Interpret common Conditional Access error codes carefully
These values may appear with an AADSTS prefix. Use them as clues, then confirm the event details and policy result; a code alone is not a complete diagnosis.
| Code | Meaning or clue | Next check |
|---|---|---|
| 53000 | DeviceNotCompliant | Check the device’s current compliance state in the organization’s management system. |
| 53001 | DeviceNotDomainJoined | Check the join requirement and device state. |
| 53002 | ApplicationUsedIsNotAnApprovedApp | Confirm whether the client is approved and supported by the organization. |
| 53003 | BlockedByConditionalAccess | Inspect the Conditional Access tab to identify the specific policy and unmet control. |
| 53004 | ProofUpBlockedDueToRisk | Review diagnostic context for risk and MFA registration or proof-up conditions. |
| 53009 | Application needs to enforce Intune protection policies | Check the app and the relevant Intune app-protection requirement. |
Not every error that looks like a policy block is a Conditional Access block. Microsoft lists 500121 for an incomplete MFA prompt; it can occur when MFA setup has not been completed. 70046 can indicate an expired session or failed reauthentication check. Consult the event’s additional details and complete the indicated MFA setup or prompt where applicable (Microsoft sign-in error troubleshooting).
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check Security Defaults and older sign-in methods
Security Defaults are a tenant-wide protection setting, not necessarily a named Conditional Access policy. Microsoft documents that they require users to register for and use MFA, block legacy authentication protocols—including some older Office clients and IMAP, SMTP, or POP3 mail connections—and block device-code-flow requests when enabled. Microsoft also says that, starting July 1, 2026, new Microsoft Entra tenants block device code flow as part of Security Defaults. That statement applies to new tenants, not as a universal claim about every existing tenant (Microsoft Security Defaults documentation).
Rank #3
If an older client, mail device, or limited-input device depends on one of these flows, tell the administrator which client and flow are involved. Use a supported authentication path where possible. Do not turn off Security Defaults merely because they interrupt an older workflow. Microsoft presents these settings as protective controls; if the organization needs granular conditions or exceptions, an authorized administrator should assess the security impact and determine whether Conditional Access is the appropriate configuration route. Microsoft’s documentation also states that MFA blocks “over 99.2% of identity-based attacks,” in the context of explaining removal of the 14-day MFA registration grace period beginning July 29, 2024; this is Microsoft’s stated figure, not a claim about every threat or an independently verified estimate (Security Defaults documentation).
When several users or apps fail at once
A cluster of failures points toward a shared change or shared state, but does not by itself prove which one. Compare affected users, devices, applications, and event results before considering a tenant-wide change.
- If failures began around the same time, inspect Entra audit logs for Conditional Access policy changes near the incident. Microsoft says audit-log data is retained for 30 days by default. Organizations can route it to Log Analytics, archive storage, Event Hubs, or a partner destination for longer retention (Microsoft audit-log guidance).
- If the events share devices or a device-management state, check whether that device group has fallen out of compliance.
- If one app appears to fail while another related service is named as the resource, inspect the resource as well as the visible app. A Teams attempt, for instance, may involve Exchange/Outlook or SharePoint.
- For sign-in risk, external or B2B access, MFA registration, legacy authentication, or app-side configuration, use the event’s diagnostic result to direct the fix to the responsible layer.
Use diagnostics or escalate with the event details
When the policy tab does not make the failure clear, an administrator can run Microsoft Entra Sign-in diagnostics for contextual explanations and suggested actions, or use the Conditional Access What If tool to evaluate how a policy applies to a scenario. Keep the correlation or request ID and the sign-in time if contacting Microsoft support (Microsoft Entra Sign-in diagnostics; Conditional Access troubleshooting).
If the policy has locked out an administrator
First check whether another administrator can still access the tenant and safely correct or disable the policy responsible. If no administrator can update it, submit a Microsoft support request. Microsoft says support reviews the case and, after confirming the lockout, updates policies that prevent access (Microsoft Conditional Access troubleshooting).
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
