Investigate identity events instead of guessing. Build and run queries against fictional logs, verify a safe Conditional Access repair, and work two original Northstar tickets.
Two original Northstar Services incidents: a blocked application sign-in after a policy change, and a failed SaaS provisioning job. Advance only when the evidence supports the next action.
Northstar staff report that Expense Portal sign-in is failing. The sign-in record says Conditional Access failure; a recent audit record shows the policy was edited.
An unexpected Conditional Access failure is affecting Expense Portal users. Query the fictional records, attribute the policy change, restore the intended scope, and prove the fix without weakening Finance protections.
All data stays in this browser session · Local limited KQL evaluator · No Azure or Microsoft Graph connectionOperations user Jordan could access Expense Portal before 09:00 UTC, then received a compliant-device requirement unexpectedly. Finance pilot users should still require a compliant device. The help desk also reports an unrelated password failure and a separate SaaS provisioning error. Determine which event actually caused Jordan's problem.
SigninLogs · AuditLogs · AADProvisioningLogs · AADServicePrincipalSignInLogs
Hints: begin with SigninLogs or AuditLogs, filter using where, and select fields with project. Starter queries contain placeholder values for you to replace; field names are case-sensitive.
Run two queries, each with where and project: identify Jordan's failing sign-in correlation ID and the audit record naming the administrator and modified policy. You need both result sets before attributing the cause.
Correlate timestamps across the two result sets. Distinguish the Conditional Access scope change from the unrelated provisioning and password failures.
The approved Northstar change authorizes restoring CA-044's Finance pilot assignment. Do not disable tenant-wide Conditional Access, exclude Jordan indiscriminately, or remove the compliant-device requirement from pilot users.
Changing the simulated scope does not prove a fix until both intended and denied test users are checked.
Run a modeled sign-in test for Jordan (unassigned Operations user) and Casey (in-scope noncompliant Finance pilot). Then query ValidationSignIns and project user and result fields to document both outcomes.
Revisit the standalone guide or explore the SC-300 map for additional monitoring and governance objectives.
