M365 Sign-in Issues

You are diagnosing a Microsoft 365 / Entra sign-in failure. The rule: get the AADSTS error code
from the Entra sign-in logs before proposing anything — the code plus that event's Conditional
Access tab usually names the cause.

Climb the Troubleshooting Ladder base skill first: this user's past tickets and the same error
across the client (many users starting together is a tenant-wide change — a CA edit, license, or
federation — treat it as an incident), then the client's documentation for the identity setup:
cloud-only versus hybrid, MFA-method standard, named CA policies, device-join type.

Then open Sign-in logs in the Entra admin center and capture from the failing event: AADSTS
code, failure reason, Conditional Access result, device info, location or IP. A client-side
dialog screenshot is not enough. Look the code up against Microsoft's documented list on the
web; never paraphrase one from memory.

Branch:

a. Conditional Access — a named policy shows Failure. Read which control failed: location,
   device compliance, app, or MFA. A user legitimately outside policy (new location, unenrolled
   device) is brought into policy — never edit a CA policy, exclude a user, or relax a policy as
   a fix. Escalate to the identity owner, with
   the policy name and evidence, when a recently edited policy blocks a class of users.

b. MFA loop — repeated prompts, or approvals that never arrive. Check registered methods for
   stale devices (an old phone still primary), TOTP time drift, and whether a CA policy demands
   a method the user lacks.

c. "Keeps asking for password" — auth succeeds in the logs but apps re-prompt, usually stale
   cached credentials or broken token refresh on one device. Sign out of all Office apps, clear
   stored Microsoft credentials in the OS credential store, sign in fresh. One app alone
   misbehaving belongs to that app's playbook.

d. Device trust — the error names device state, or CA requires a compliant or joined device. Run
   dsregcmd /status and read AzureAdJoined, DomainJoined and DeviceAuthStatus, then check the
   Entra device record and MDM compliance state. Hybrid-join failures are often sync-related, so
   check the last Entra Connect sync. Escalate to the identity owner when PRT or sync problems
   affect multiple devices.

e. Account state — disabled account, expired password, or a risk-based block. Never simply
   unblock a risk flag: confirm what happened with the user, and pair with the security
   playbooks if the sign-in wasn't theirs.

Before any credential or MFA reset, verify identity by calling back a number already on file —
never a number supplied in the ticket thread. Verification is a fresh successful sign-in event
in the logs, not the user's "seems ok". Then leave a plain-text internal note (apply the PSA
Note Discipline base skill): AADSTS code, CA result, branch, action or handoff, event time.