What This Category Covers
Security and continuity issues need evidence before containment or recovery work. Separate detection, policy, identity, endpoint state, backup/recovery status, and business impact.
First Layer to Isolate
Security signal first, then scope, containment, recovery path, and business priority.
Useful Tools, Logs, and Portals
- Security portal
- RMM/EDR logs
- Backup console
- Identity logs
- Change history
- Incident notes
Before You Escalate
- Impact and scope captured
- Security owner notified where needed
- Recovery point verified
- Changes documented
Articles in This Path
Pick the closest symptom and work from there.
Terms of use acceptance loops on first login after policy assignment
Field Summary
Terms of use acceptance loops on first login after policy assignment is a Conditional Access ticket where the visible symptom can be misleading. When this Microsoft 365 workflow fails, separate account access, web-versus-desktop behavior, token state, licensing, Conditional Access, and service health before changing the client. The fastest path is to identify which layer changed and prove it with logs or a repeatable test.
Service account blocked after policy intended only for interactive sign-ins
Field Summary
Service account blocked after policy intended only for interactive sign-ins is a Conditional Access ticket where the visible symptom can be misleading. When this Microsoft 365 workflow fails, separate account access, web-versus-desktop behavior, token state, licensing, Conditional Access, and service health before changing the client. Start with the exact sign-in attempt and policy result; password resets without log evidence often create a second problem.
Conditional Access template duplicated and now two policies conflict
Field Summary
Conditional Access template duplicated and now two policies conflict is a Conditional Access ticket where the visible symptom can be misleading. When this Microsoft 365 workflow fails, separate account access, web-versus-desktop behavior, token state, licensing, Conditional Access, and service health before changing the client. The fastest path is to identify which layer changed and prove it with logs or a repeatable test.
Trusted network exclusions work for IPv4 but not IPv6 clients
Field Summary
Trusted network exclusions work for IPv4 but not IPv6 clients is a Conditional Access ticket where the visible symptom can be misleading. When this Microsoft 365 workflow fails, separate account access, web-versus-desktop behavior, token state, licensing, Conditional Access, and service health before changing the client. The fastest path is to identify which layer changed and prove it with logs or a repeatable test.
Legacy app protected by app proxy bypasses expected Conditional Access policy
Field Summary
Legacy app protected by app proxy bypasses expected Conditional Access policy is a Conditional Access ticket where the visible symptom can be misleading. When this Microsoft 365 workflow fails, separate account access, web-versus-desktop behavior, token state, licensing, Conditional Access, and service health before changing the client. The fastest path is to identify which layer changed and prove it with logs or a repeatable test.
Session controls block file download in SharePoint but not in Teams preview
Field Summary
Session controls block file download in SharePoint but not in Teams preview is a Conditional Access ticket where the visible symptom can be misleading. When this Microsoft 365 workflow fails, separate account access, web-versus-desktop behavior, token state, licensing, Conditional Access, and service health before changing the client. The fastest path is to identify which layer changed and prove it with logs or a repeatable test.
Mac browser marked unsupported because device ID claim missing from session
Field Summary
Mac browser marked unsupported because device ID claim missing from session is a Conditional Access ticket where the visible symptom can be misleading. When this Microsoft 365 workflow fails, separate account access, web-versus-desktop behavior, token state, licensing, Conditional Access, and service health before changing the client. The fastest path is to identify which layer changed and prove it with logs or a repeatable test.
Policy excludes break-glass accounts yet sign-in frequency rule still applies
Field Summary
Policy excludes break-glass accounts yet sign-in frequency rule still applies is a Conditional Access ticket where the visible symptom can be misleading. When this Microsoft 365 workflow fails, separate account access, web-versus-desktop behavior, token state, licensing, Conditional Access, and service health before changing the client. Start with the exact sign-in attempt and policy result; password resets without log evidence often create a second problem.
Named location trusted list updated but browser sessions keep prompting MFA
Field Summary
Named location trusted list updated but browser sessions keep prompting MFA is a Conditional Access ticket where the visible symptom can be misleading. When this Microsoft 365 workflow fails, separate account access, web-versus-desktop behavior, token state, licensing, Conditional Access, and service health before changing the client. Start with the exact sign-in attempt and policy result; password resets without log evidence often create a second problem.
Conditional Access report-only logs differ from real enforcement outcome
Field Summary
Conditional Access report-only logs differ from real enforcement outcome is a Conditional Access ticket where the visible symptom can be misleading. When this Microsoft 365 workflow fails, separate account access, web-versus-desktop behavior, token state, licensing, Conditional Access, and service health before changing the client. The fastest path is to identify which layer changed and prove it with logs or a repeatable test.