Incident Overview
A fictional company, Contoso Example, changed its external MFA provider on Monday. By mid-morning, helpdesk reports that some staff cannot sign in to Microsoft 365 and see AADSTS50158.
Others are unaffected. You are the on-call administrator with read-only access to sign-in logs and Conditional Access configuration.
Investigation Options
Review the available operational moves and select the best immediate action.
A
Narrow the policy to the pilot group, or restore its prior approved state, under change control
B
Disable Conditional Access for the whole tenant until investigation ends
C
Force password resets for all affected users
D
Open a Microsoft support case and wait without changing anything