Troubleshooting Conditional Access Policies Causing User Lockouts

Explore Our Microsoft Cloud Security Training →

Managing Entra Conditional Access policies can be challenging, especially when it comes to preventing user lockouts. In this article, we provide a practical guide for troubleshooting and resolving issues that lead to user lockouts.

Using What If Tool Before Policy Enforcement

Always test new policies with the What If tool, simulating realistic user scenarios. This helps ensure that your policies are functioning correctly before being enforced on users.

Report-Only Mode as the Safe Rollout Standard

Deploy policies in Report-only mode for 1 to 2 weeks, monitoring via Conditional Access Insights workbook. This allows you to identify any potential issues before enforcing the policy on users.

Break-Glass Account Exclusion Best Practices

Maintain at least two break-glass accounts excluded from all policies and alert on their usage. These accounts should be used only in emergency situations when regular authentication fails.

Sign-in Log Analysis with KQL for Affected Users

For lockouts, use KQL: SigninLogs | where UserPrincipalName == 'user@domain.com' | mv-expand ConditionalAccessPolicies | where ConditionalAccessPolicies.result == 'failure'

Common Lockout Patterns (Compliant Device, MFA Loops)

• Requiring compliant device before all users have onboarded to Intune: Stagger enforcement by group.
• MFA loops: Investigate the policy causing the issue and adjust as necessary.

Explore Our Microsoft Cloud Security Training →