How to check which Conditional Access Policy is blocking a user log-in – Azure AD

General Introduction

If you have Conditional Access Policies in place to block certain log-ins, you might get that a user will contact you because their sign-in request is being blocked. Probably both you and the user don’t know which policy is making the log-in fail, since it’s not specified in the error message.

The usual error message is something along the lines of: “Your sign-in was successful, but does not meet the criteria to access this resource. For example, you might be signing in from a browser, app or location that is restricted by your admin.” and the standard error code is “BlockedByConditionalAccess” error 53003

How to solve

To get more details:

• Go to the Sign-in logs page in Azure AD: Azure AD | Sign-in logs
• Filter by username or by the field you prefer

• Click on the failed log-in request
• Click on “Conditional Access“
• The Policies that have as a result “Failure” and “Grant Controls” set on “Block” are the ones blocking the user.