The laptop starts normally. The new agent can reach the internet, but Outlook or a shared document stops at an access message. Resetting the password again may not address the reason Microsoft 365 refused the session.
For a small Maryland insurance agency, this can interrupt onboarding before the agent handles their first customer request. Start by recording the failed sign-in, then have an authorized administrator identify the requirement that was not met.
Capture the failure before changing the laptop
Write down the work account, affected application, exact time and time zone, and the full error message. If the screen offers troubleshooting details, retain the error code and correlation or request ID for the administrator.
Record whether the failure happens in the browser, desktop application or both. Do not put passwords, policyholder records or full diagnostic screenshots containing private information in a public support request.
Confirm that the person is using the agency's intended work account. A browser with multiple signed-in accounts can make the situation harder to interpret. Do not assume that every access-denied message means the laptop is noncompliant.
Ask the administrator to inspect the matching sign-in
Microsoft recommends using the error details and Microsoft Entra sign-in logs to investigate unexpected Conditional Access outcomes. The administrator should locate the matching event and review the Conditional Access results, along with its application and device details.
The useful question is specific: which policy or requirement affected this attempt? A policy might require a compliant device, another authentication step or a different condition. Record the actual result instead of guessing from the wording on the laptop.
See Microsoft's Conditional Access troubleshooting guide.
If compliance is required, match the right device record
Intune can evaluate device compliance, while Entra Conditional Access can use that result when deciding whether to allow access. These are related functions, not interchangeable labels.
Have the administrator confirm the laptop's identity and its intended enrollment and account configuration. Check the relevant Intune record, assigned compliance policy and the particular setting reported as failing. Avoid making changes to an older record simply because its display name looks familiar.
For example, a hypothetical agency might require a supported operating-system version before allowing access to work files. If that is the documented failing requirement, the next step is the agency-approved update process, followed by a fresh evaluation and sign-in test. It is not a reason to remove the requirement for everyone.
Check onboarding assignments and timing
For a newly enrolled laptop, the administrator should review the user's required license and policy assignments. Microsoft's Intune Conditional Access troubleshooting guidance also notes that compliance information can take time to register after enrollment or an update.
That makes a recorded timeline useful: when enrollment completed, what remediation finished, when the device last reported and when the next sign-in was attempted. Waiting indefinitely without checking the records is not a troubleshooting plan.
Do not repeatedly unenroll the laptop, delete device records or factory-reset it as a first step. Those actions can create more onboarding work without establishing what blocked the original attempt.
Retest the same workflow
After the authorized remediation, repeat the same application sign-in on the same laptop. Record the result and compare the new event with the original failure.
If access is restored, test the work the agent actually needs, such as opening an approved training document. Use non-sensitive test material. A successful browser sign-in alone does not demonstrate that every required desktop application is ready.
If access still fails, give the administrator the new timestamp and error details. Another policy or an application-specific problem may need attention. Do not disable MFA, exclude the agent from security controls or use a colleague's account as a shortcut.
Make the next agent's first day easier
Add an access check to the agency's onboarding process before client work begins. Assign an owner for the laptop, confirm required accounts and licenses, and test the approved applications with the new agent.
Keep a short handoff record: device identity, enrollment status, required applications, test outcome and who to contact. This turns a vague “Microsoft 365 does not work” report into a defined support problem.
Get help with the blocked sign-in
FMA helps professional offices with employee devices and device management. If your new agent cannot access Microsoft 365, Get IT Help with the affected application, number of people affected and onboarding deadline. Keep credentials and confidential customer details out of the initial inquiry.
FMA is based in Columbia, Maryland, with remote support nationwide. Scope and cost are discussed before paid work begins, and a managed IT contract is not required.
