Why Conditional Access Blocks Users — and How to Find Out Why

Why can a user be blocked even when one Conditional Access policy shows a successful result? In this episode, Alex and Maya examine how Microsoft Entra evaluates Conditional Access and why a successful policy does not necessarily mean that access will be granted. The discussion explores the difference between a policy that did not apply and one that actually failed, how multiple applicable policies can combine requirements, and why troubleshooting requires finding the requirement that remained unsatisfied. The episode then moves from the evaluation model into practical troubleshooting. Alex and Maya explore authentication strength, session controls, Authentication Context, the roles of What If, Report-only mode, and sign-in logs, and a six-step method for tracing an access failure from the exact sign-in event to its root cause. The goal is to replace guesswork and emergency policy changes with an evidence-first approach that fixes the actual cause while preserving the security posture. The central lesson is straightforward: Conditional Access is a parallel evaluation, not a sequential checklist. Do not look for the policy that blocked the user; find the requirement that remained unsatisfied. This episode is based on the Support Engineering Blog article “Why Is Conditional Access Blocking My User? A Systematic Troubleshooting Method”, including its troubleshooting method, policy evaluation model, root-cause guidance, investigation tools, and supporting diagrams. Chapters 00:00 - Why a Successful Policy Can Still Mean Blocked 02:08 - Why Conditional Access Isn't a Firewall 05:15 - Applicability: Which Policies Actually Apply 11:04 - When Multiple Policies Stack Requirements 14:16 - Authentication Strength and Session Controls 17:26 - Authentication Context and Step-Up Access 19:12 - The Tools and Evidence That Matter 20:40 - The Six-Step Troubleshooting Method 23:07 - From Static Logs to Continuous Access Learn more: The full technical article, references and supporting resources are available through the Support Engineering Blog on the URL https://blog.sadhan.ch/,