Troubleshooting · Identity
User cannot sign in
Authentication fails for one user, or for a group of users, across one or more applications.
Work through these in order
- 01
Confirm the scope
One user, one application, one location, or everyone? Scope immediately separates account issues from policy or outage issues.
- 02
Check account state
Enabled, not locked, password not expired, licence assigned where required.
- 03
Read the sign in log
The failure reason and the applied policy are recorded, this usually ends the investigation.
- 04
Check access policy
Conditional Access or equivalent: was the request blocked by device compliance, location or risk?
- 05
Check MFA state
Registered methods present, device time correct for TOTP, no recent method changes.
- 06
Check on premises dependencies
For hybrid: directory synchronisation health, domain controller availability, time skew for Kerberos.
- 07
Confirm the application trust
Certificate expiry, reply URLs, or a broken federation trust affect all users of one application.
Background reading
Microsoft Entra ID
Microsoft's cloud identity and access management service, the identity control plane for Microsoft 365, Azure and thousands of federated applications.
Conditional Access
Policy that evaluates signals about the user, device, application, location and risk at sign in, then grants, blocks or constrains access.
Multi Factor Authentication
Requiring two or more independent factors, something you know, have or are, before granting access.
Kerberos
A ticket based authentication protocol that proves identity to services without sending the password across the network.
Active Directory
Microsoft's on premises directory service, providing authentication, authorisation, policy and object management for Windows environments.