Guide · Microsoft 365
From an expired licence to a two-factor lockout to Conditional Access: why sign-ins fail and how to tell the causes apart.
“I can’t get in” can have a dozen causes that have nothing to do with each other. Three questions narrow the case down in a minute and save most of the searching.
Does it affect one person or several? Does it affect all of that person’s devices or just one? And does signing in work via the web interface in the browser? These three answers almost always point in the right direction.
By frequency
Sorted by how often we actually encounter them.
A subscription was not renewed, a licence was removed during a clean-up, or a payment failed. Signing in often still works, but the applications refuse to run.
New phone, reset device, deleted app. Signing in with the password works, the second factor is missing – and nobody gets any further without it.
After too many failed attempts, or when Microsoft detects unusual sign-in attempts. Often triggered by an old device that keeps trying in the background with an outdated password.
Rules that block sign-ins from abroad, from unknown devices or from outside the company network. This shows up on business trips and on holiday – the rule is intentional, it just has not been communicated.
If the system time is significantly off, encrypted connections fail. Typical after a flat CMOS battery in the computer or on devices that have been switched off for a long time.
Windows stores credentials. After a password change, it keeps trying with the old one – and may lock the account as a result.
The Microsoft 365 admin portal records what happened for every sign-in. It is the most reliable source – and is rarely used.
Frequently asked questions
The second factor has to be reset by an administrator and set up again. That is intentional: if you could reset it yourself, it would be worthless.
You can prevent this by having everyone register two methods from the start – for example the app and a phone number. Then one route remains open when a device is changed. Setting this up takes two minutes and saves quite a few calls a year.
Almost always, a device in the background keeps trying with an old password – a second phone, a tablet, a printer with scan-to-email, or an old Outlook installation. Every attempt counts towards the lockout.
The sign-in log shows where the attempts are coming from. After that, it is usually sorted in five minutes.
For many businesses, yes – it significantly reduces the number of automated attacks. The prerequisite is that you take business trips and holiday periods into account and have a way of setting an exception at short notice.
Communication is key. A rule that nobody knows about turns the first business trip into an emergency that is not really one.
Directory synchronisation creates two sources of error. First, synchronisation can stall – then password changes do not arrive, and sign-in fails exactly one hour after the change. Second, duplicate accounts arise if someone already had a cloud account before synchronisation.
Both are visible in the admin portal, but only if you know where to look. This belongs in the documentation.
The admin portal has a service health overview. If several people are affected at the same time and for no obvious reason, that is the first place to look.
Keep an access route that works independently of your own environment – an admin account whose two-factor authentication is not tied to a company device, stored securely. Otherwise, during an outage, you will be unable to get into exactly the place you need to check.
Dipl.-Ing. Mohamed Khater
Dipl.-Ing. Mohamed Khater founded INFONET Computer GmbH in Cologne in 1992. Sign-in problems are the most common Microsoft 365 support call – and in most cases can be resolved within a few minutes by reading the sign-in log instead of guessing.
Free inventory
We look at accounts, licences, two-factor set-up and policies as a whole – and regularly find licences for people who left the company long ago.
+49 221 984300-0Switchboard and support hotline
[email protected]Reply within 4 hours on working days
Robert-Perthel-Straße 7250739 Köln – Bilderstöckchen
Mon–Fri 9 am–6 pmEmergency support outside these hours by arrangement
This website works without cookies, without tracking and without advertising networks. For one optional feature we embed content from an external provider. Doing so transfers your IP address to that provider – which only happens if you allow it.
