Incident Overview
At the start of a fictional working day, staff at the invented company Contoso Example report that sign-in fails with a message saying access has been blocked. A colleague edited a named location the previous evening to add a new office range.
Help desk reports say the problem affects office users and some remote users, but not everyone.
Investigation Options
Review the available operational moves and select the best immediate action.
A
Review the audit entry and What If result, then restore the trusted flag through change control with peer review
B
Disable the block policy for all users immediately without further investigation
C
Add every affected user to a policy exclusion list
D
Reset passwords and MFA methods for all affected users