Use this skill when asked to investigate Conditional Access policy changes, sign-in failures related to CA policies (error codes 53000, 50074, 530032), or suspected policy bypass/manipulation. Triggers on keywords like "Conditional Access", "CA policy", "device compliance", "policy bypass", "53000", "50074", or when investigating why a user was blocked then suddenly unblocked. This skill provides forensic analysis of CA policy modifications correlated with sign-in failures.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Use this skill when asked to investigate Conditional Access policy changes, sign-in failures related to CA policies (error codes 53000, 50074, 530032), or suspected policy bypass/manipulation. Triggers on keywords like "Conditional Access", "CA policy", "device compliance", "policy bypass", "53000", "50074", or when investigating why a user was blocked then suddenly unblocked. This skill provides forensic analysis of CA policy modifications correlated with sign-in failures.
When investigating sign-in failures (error codes 53000, 50074) with CA policy correlation:
⚠️ MANDATORY STEPS - DO NOT SKIP:
Query ALL CA policy changes in chronological order (±2 days from failure time)
Parse policy state transitions from the JSON (enabled → disabled → report-only)
Compare failure timeline with policy change timeline
Verify logical consistency: Ask "does this make sense?"
Key Questions to Answer:
Was the user blocked BEFORE the policy change?
Did the policy change resolve the block?
Who initiated the policy change? (same user = suspicious)
What was the business justification?
Common Error Codes
Error Code
Description
Typical Cause
53000
Device not compliant
Device not enrolled in Intune or failing compliance checks
50074
Strong authentication required
MFA not satisfied
50074
User must enroll in MFA
MFA not configured for user
530032
Blocked by CA policy
Generic CA policy block
65001
User consent required
Application consent needed
53003
Access blocked by CA policy
Explicit block condition met
70044
Session expired
User needs to re-authenticate
Error Code Investigation Priority
Priority
Error Codes
Investigation Focus
HIGH
53000, 530032, 53003
Device compliance, CA policy blocks - check for policy manipulation
MEDIUM
50074
MFA requirements - check if MFA was bypassed
LOW
65001, 70044
Consent/session issues - usually not security-related
CA Policy State Meanings
State
What It Means
Security Impact
enabled
Policy actively enforcing
Blocks non-compliant access (intended behavior)
disabled
Policy not enforcing
Security control bypassed - all access allowed
enabledForReportingButNotEnforced
Report-only mode
Logs violations but doesn't block - defeats purpose
State Transition Risk Assessment
Transition
Risk Level
Interpretation
enabled → disabled
HIGH
Complete security bypass
enabled → enabledForReportingButNotEnforced
MEDIUM-HIGH
Partial bypass (monitoring only)
disabled → enabled
LOW
Security restored (good)
enabledForReportingButNotEnforced → enabled
LOW
Security strengthened (good)
Investigation Workflow Pattern
Step 1: Identify Sign-In Failures
Query sign-in failures with CA context:
// Get failures with CA context
union isfuzzy=true SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated between (datetime(<START>) .. datetime(<END>))
| where UserPrincipalName =~ '<UPN>'
| where ResultType != '0'
| where AppDisplayName has '<APPLICATION>' // e.g., "Visual Studio Code"
| project TimeGenerated, IPAddress, Location, ResultType, ResultDescription,
ConditionalAccessStatus, UserAgent
| order by TimeGenerated asc
What to Look For:
ResultType values: 53000, 50074, 530032, 53003
ConditionalAccessStatus: "failure", "notApplied"
Pattern of repeated failures followed by success
Step 2: Query ALL CA Policy Changes in Timeframe
CRITICAL: Query ±2 days from the first failure time
let failure_time = datetime(<FIRST_FAILURE_TIME>);
let start = failure_time - 2d;
let end = failure_time + 2d;
AuditLogs
| where TimeGenerated between (start .. end)
| where OperationName has_any ("Conditional Access", "policy")
| where Identity =~ '<UPN>' or tostring(InitiatedBy) has '<UPN>'
| extend InitiatorUPN = tostring(parse_json(InitiatedBy).user.userPrincipalName)
| extend InitiatorIPAddress = tostring(parse_json(InitiatedBy).user.ipAddress)
| extend TargetName = tostring(parse_json(TargetResources)[0].displayName)
| project TimeGenerated, OperationName, Result, InitiatorUPN, InitiatorIPAddress,
TargetName, CorrelationId
| order by TimeGenerated asc // CRITICAL: Chronological order
Critical Analysis Points:
InitiatorUPN: Who made the change? Same user as blocked = suspicious
TargetName: Which policy was modified?
TimeGenerated: Did change occur AFTER sign-in failures?
Order: Always chronological (oldest first) to see cause/effect
Step 3: Parse Policy State Changes
For each CorrelationId from Step 2, get detailed changes:
// Get detailed property changes for a specific policy modification
AuditLogs
| where CorrelationId == "<CORRELATION_ID>"
| extend ModifiedProperties = parse_json(TargetResources)[0].modifiedProperties
| mv-expand ModifiedProperties
| extend PropertyName = tostring(ModifiedProperties.displayName)
| extend OldValue = tostring(ModifiedProperties.oldValue)
| extend NewValue = tostring(ModifiedProperties.newValue)
| project TimeGenerated, PropertyName, OldValue, NewValue
