A status of Failure means the account was unable to logon even though the CA policy was successfully applied ( The Success for Conditional Access you noted)
Clarify Status vs Conditional Access on Sign-in logs
Looking at the Sign-in logs of a user in the Microsoft Entra admin center, I'd like to understand the difference between a Success value in the "Status" vs "Conditional Access" columns. What do each of these represent? Related to this, a specific situation I'd like to clarify is what is the result of the following combination: Status is "Failure" while Conditional Access is "Success". Does this combination result in the user getting access or getting denied for that particular sign-in attempt?
Microsoft Security | Microsoft Entra | Other
-
Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator
2024-01-25T16:25:14.2933333+00:00
1 additional answer
Sort by: Most helpful
-
Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator
2024-01-25T16:30:24.34+00:00 Hi, this may help with that: https://learn.microsoft.com/en-us/entra/identity/conditional-access/troubleshoot-conditional-access#microsoft-entra-sign-in-events I really like the insights page and recommend using: https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-insights-reporting