This video tutorial from Microsoft demonstrates how an administrator can investigate unexpected blocks by Conditional Access policies in their environments.

Azure Active Directory is now Microsoft Entra ID, all other Azure Active Directory branded products are now “Microsoft Entra”. Any reference to Azure Active Directory within this video should be replaced with Microsoft Entra or Microsoft Entra ID as applicable.