Free tools Windows power users keep installed
One-click scans. No signup required.
When a Zero Trust login fails, start with the identity provider’s sign-in event—not just the message on screen. The event identifies the policy, authentication requirement, device signal, or resource that blocked access. Zero Trust controls differ by provider and organization; the Microsoft Entra steps below are a worked example, not universal menus or error codes.
Start with the failed sign-in event
- Capture the details before retrying. Record the full error text, date and time with time zone, username, app or resource, client, device, and any correlation or request ID. These details help an administrator locate the matching event.
- Open the matching event in Entra. In Microsoft Entra admin center, go to Entra ID → Monitoring & health → Sign-in logs. Filter by user, date, resource, or correlation ID, then select the event.
- Read the policy decision and sign-in signals. Review the Conditional Access tab to see which policies applied and why. Also inspect Troubleshooting and support, Basic Info, Location, Device Info, Authentication Details, and Additional Details. Microsoft recommends reviewing sign-in events to identify the policies that applied and why: Troubleshooting sign-in problems with Conditional Access.
Classify the unmet requirement before changing a setting. It may involve credentials or account state, MFA or authentication strength, device registration or compliance, an unapproved client, location or risk, a dependent resource, or policy scope. One app sign-in can request access to multiple resources, so a policy tied to another resource may explain an error that appears to come from the app you opened.
As an Amazon Associate I earn from qualifying purchases.
Fix MFA and authentication-method failures
First determine what authentication the policy required. In the event, Authentication Details shows the authentication requirement; the relevant Conditional Access policy’s Grant Controls shows its authentication strength. Then check that the user has registered a method allowed by the organization’s authentication-method policy. A method that is required but unavailable to the user cannot satisfy the policy.
If the required method is registered and enabled but does not appear after primary authentication, restart the sign-in and choose Sign-in options. Some methods require setup that cannot be completed within the current sign-in flow. Microsoft’s guidance explains how to interpret the event and check method registration and policy configuration: Troubleshoot Conditional Access Authentication Strengths.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A FIDO2 security key may be an option when the organization allows it and requires or accepts phishing-resistant MFA. Confirm the tenant policy, supported behavior, and approved purchasing channel before obtaining one. A key will not resolve a password problem, device-compliance failure, unsupported client, incorrect policy scope, or identity-provider outage. Microsoft lists FIDO2 security keys among phishing-resistant methods: Security guidance – Protect identities and secrets.
Resolve device-compliance and client problems
A device-compliance denial is not necessarily fixed by changing the sign-in method. Check both the device’s state and the management configuration that supplies its compliance status:
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Is the device joined or registered in the state the policy requires?
- If management is required, is it enrolled with the organization’s management service?
- Is a compliance policy assigned, and does the device report the required state?
- Is the user signing in through a supported client configured for that platform and tenant?
Microsoft describes compliance enforcement as a collaboration between Intune and Entra Conditional Access. Client prerequisites can vary by platform: Company Portal or Authenticator setup may be required, and Microsoft documents a Chrome extension requirement for a comparable Windows sign-in experience. Check the current requirements for the actual tenant and platform in Prerequisite work for implementing Zero Trust identity and device access policies and How to Require Device Compliance with Conditional Access.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsUse Entra error codes as clues, not diagnoses
These codes are specific to Microsoft Entra. Confirm the matching event and policy result before deciding what to change; a code alone may not expose the full cause.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Code | Entra label | What to inspect |
|---|---|---|
| 53000 | DeviceNotCompliant | Device details, compliance result, and assigned compliance policy. |
| 53001 | DeviceNotDomainJoined | The required join or registration state. |
| 53002 | ApplicationUsedIsNotAnApprovedApp | Allowed-client or app-protection requirements. |
| 53003 | BlockedByConditionalAccess | The evaluated policy and unmet condition or grant control. |
| 53004 | ProofUpBlockedDueToRisk | Risk evaluation and proof-up requirements. |
| 53009 | Application needs to enforce Intune protection policies | App-protection policy support and assignment. |
Microsoft’s Conditional Access troubleshooting guide lists these codes and their context.
Check policy scope before editing controls
For an unexpected policy result, compare the event’s observed sign-in facts with the policy configuration. Check the affected user or group, target resource, platform, client, device state, location, grant controls, and exclusions. Use the sign-in diagnostic or What If tool to investigate after reviewing the actual event. Conditional Access evaluates sign-in conditions against the policy’s scope and controls; Microsoft’s planning guidance is in Identity, the first pillar of a Zero Trust security architecture.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Make the narrowest safe correction
Fix the signal that failed while preserving the security requirement where possible. Depending on the event, that may mean completing device enrollment, correcting a compliance-policy assignment, registering an allowed MFA method, switching to a supported client, or correcting an incorrectly scoped policy.
A broad policy change can affect more people or resources than the blocked user. Microsoft recommends evaluating device-compliance policy impact in report-only mode before enabling it and maintaining emergency-access accounts to mitigate lockouts. Avoid removing MFA or device controls as a first troubleshooting step; use only an approved, narrow, time-bounded exception when organizational procedure allows it. See Microsoft’s device-compliance guidance.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Recover if administrators are locked out
If another authorized administrator can still sign in, that administrator can disable the policy causing the lockout. If every administrator is blocked, Microsoft’s troubleshooting guidance directs the organization to submit a support request. Include the request ID, date, and time from the failed event so support can identify it: Troubleshooting sign-in problems with Conditional Access.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
