Microsoft 365 Support Pro: Sign-in, MFA and Lockouts

What's inside

1. Level 1: Microsoft 365 Sign-in on One PageFree
   Covers what a user sees from the first sign-in prompt to their inbox, what Entra ID does behind each screen, and the course's independence from Microsoft.
2. Level 2: Behind the Prompt: Accounts, Tokens and SessionsFree
   Explains cloud-only, synced and federated accounts, tokens and sessions in support terms, so you can see why a fix sometimes takes effect at once and sometimes only after the user signs in again.
3. Level 3: The Smallest Role for Each Support Job
   Matches each sign-in support task to the least-privileged built-in Entra role, including the limits on which users each role is allowed to act on.
4. Level 4: Licences That Decide What You Can See and Do
   Shows how Entra ID Free, P1 and P2 control which features support can use, such as self-service reset writeback, Conditional Access, Identity Protection risk reports and how long sign-in logs are kept.
5. Level 5: Mapping the Admin Screens and Dating Your Facts
   Covers the Entra admin center, the Microsoft 365 admin center and the user's My Sign-ins portal, and how to check each console path, role and limit against Microsoft's current documentation and record the date you checked.
6. Level 6: Admin Password Resets Done Safely
   Walks through resetting a user's password from the admin centres, with identity verification first, a temporary password, a forced change and the right hand-off to the user.
7. Level 7: Self-Service Password Reset: Scope and Registration
   Reads the tenant's self-service password reset settings to see who is in scope, which methods and how many are required, and helps a user register through My Sign-ins.
8. Level 8: Reading the Authentication Methods Policy for a User
   Explains how to work out which sign-in methods a particular user is allowed to register and use by reading each method's targeting, system-preferred MFA and any registration campaign.
9. Level 9: Viewing and Adding a User's MFA Methods
   Covers reading a user's registered methods and default method on their Authentication methods page, then adding a phone or email method for them where policy allows it.
10. Level 10: Replacing and Resetting MFA Methods
    Handles new phones and stale methods: the user moves Authenticator themselves where they can, support deletes old methods, requires re-registration and revokes sessions when needed.
11. Level 11: Temporary Access Pass: Issue, Limit, Confirm
    Issues a Temporary Access Pass so a user can sign in and register methods, after first checking that the policy allows it and setting the right lifetime and single-use option.
12. Level 12: Microsoft Authenticator: Push, Number Matching, Passwordless
    Sets up Microsoft Authenticator correctly for push approval with number matching and phone sign-in, and explains how each mode looks to the user and in the methods list.
13. Level 13: Passkeys in Authenticator and Synced Passkeys
    Registers a passkey in Microsoft Authenticator or a platform passkey provider, and reads passkey profiles (GA from March 2026) to see whether device-bound or synced passkeys are allowed for a user.
14. Level 14: FIDO2 Security Keys: Registration and Restrictions
    Registers a hardware security key for a user and checks key restrictions such as AAGUID allow lists and attestation, which decide which key models are accepted.
15. Level 15: Windows Hello for Business as Support Sees It
    Explains what Windows Hello for Business is, how it appears in a user's methods and devices, and the safe support actions: PIN reset, re-provisioning and device checks.
16. Level 16: Starters and Leavers: Sign-in End to End
    Brings the configuration tasks together for the new-starter path (Temporary Access Pass to phishing-resistant methods) and the leaver path (block sign-in, revoke sessions, remove methods).
17. Level 17: Finding the Right Sign-in Log Entry
    Covers the sign-in logs: interactive, non-interactive, service principal and managed identity views, plus filtering by user, time, application, status and correlation ID to find the event that matters.
18. Level 18: Reading a Single Sign-in Event
    Reads one sign-in record tab by tab: basic info, location, device info, authentication details and Conditional Access, along with the request and correlation IDs that escalations need.
19. Level 19: Decoding AADSTS Error Codes
    Interprets the AADSTS codes support sees most often, such as bad password, lockout, MFA required, MFA failed, account disabled and blocked by Conditional Access, and looks up unfamiliar ones.
20. Level 20: Audit Logs and Method Activity: Who Changed What
    Uses the audit logs and the authentication methods activity reports to find who reset a password, registered or deleted a method, or issued a Temporary Access Pass, and when.
21. Level 21: Reading the Conditional Access Tab of a Sign-in
    Learn to open a failed or interrupted sign-in in the Entra sign-in logs and read its Conditional Access results, telling apart policies that applied, were not applied, ran in report-only mode or failed, and which grant or session control caused the outcome.
22. Level 22: Explaining a Block with the What If Tool
    Learn to rebuild a user's sign-in scenario in the Conditional Access What If tool to confirm which policies would apply and why, and to compare that against the real sign-in log entry.
23. Level 23: Reading Risky Sign-ins and Risk Detections
    Learn to read the ID Protection risky sign-ins and risk detections reports: what the risk levels and detection types mean, which detections are real-time and which are offline, and how risk shows up in the sign-in log.
24. Level 24: Reading Risky Users and What Support May Do
    Learn to read a user's aggregate risk in the Risky users report, follow how risk is remediated by a secure password change, MFA or an admin action, and know which risk actions belong to support and which belong to security.
25. Level 25: Fault: Lost or Stolen Phone
    Work through a user who has lost the phone holding their only MFA method: check their identity, look at their registered methods, cut off the old device, get them back in with a Temporary Access Pass and have them register again.
26. Level 26: Fault: New Phone or Broken Authenticator
    Diagnose Authenticator failures on a phone the user still has, such as a phone swap, a reinstall, missing notifications or a failed restore from backup, and decide whether to repair the app or re-register the account.
27. Level 27: Fault: Repeated or Looping MFA Prompts
    Investigate users who are asked for MFA over and over or get stuck in a sign-in loop, separating sign-in frequency policy, stale tokens, browser and broker problems and suspicious push prompts.
28. Level 28: Fault: Locked Out by Smart Lockout
    Work out why a user is locked out by Entra smart lockout, tell cloud lockout apart from on-premises Active Directory lockout, and find the source of repeated bad passwords.
29. Level 29: Fault: Self-Service Password Reset Fails
    Diagnose a failed self-service password reset by checking the user's scope, registration, available methods, password policy and writeback, using the SSPR audit and activity reports.
30. Level 30: Fault: Passkey in Authenticator Will Not Work
    Troubleshoot passkey registration and sign-in failures with Microsoft Authenticator, covering policy scope, attestation, the device and OS, and cross-device Bluetooth sign-in.
31. Level 31: Fault: Security Key Sign-in Fails
    Diagnose FIDO2 security key failures, including blocked key models (AAGUIDs), PIN problems, a reset key and browser or OS limits, and decide when to re-register the key and when to replace it.
32. Level 32: Fault: Windows Hello for Business Failures
    Diagnose Windows Hello for Business problems, such as a failed PIN or biometric setup, a forgotten PIN and sign-ins that do not reach cloud resources, using device-side checks before tenant ones.
33. Level 33: Fault: Hybrid Password Out of Step
    Diagnose hybrid users whose cloud and on-premises passwords disagree, by reading the account's source, the sync status and password writeback, without changing sync configuration.
34. Level 34: Fault: Hybrid Account Disabled, Missing or Duplicate
    Diagnose hybrid accounts that are disabled, missing from the cloud or duplicated, which support often meets as 'user does not exist' or 'account disabled' errors, and work out where the fix has to happen.
35. Level 35: Fault: Guest Cannot Accept an Invitation
    Diagnose B2B guest redemption failures such as wrong-account sign-ins, expired or reused invitations, blocked domains and email one-time passcode problems, from the inviting tenant's point of view.
36. Level 36: Fault: Guest Blocked by MFA or Access Policy
    Diagnose guests who redeem successfully but are then blocked, by reading Conditional Access results for external users and the cross-tenant access settings that decide whether their home tenant's MFA is trusted.
37. Level 37: Recognising Account Takeover
    Learn the warning signs of a compromised Microsoft 365 account across sign-in logs, MFA registration events, risk reports and user reports, so a support ticket that looks routine is handled as a possible security incident.
38. Level 38: First Response: Containing a Compromised Account
    Carry out first containment steps in the right order: block sign-in, revoke sessions, reset the password, remove methods the attacker added and then restore safe access, recording each step for the security team.
39. Level 39: After Containment: Persistence Checks
    Check the places an attacker leaves behind after a takeover, including mailbox forwarding and inbox rules, app consents, registered devices and new MFA methods, using read-only views before reporting what you find.
40. Level 40: Read-only Checks with Microsoft Graph PowerShell
    Use the Microsoft Graph PowerShell SDK with least-privilege, read-only scopes to pull a user's sign-ins, authentication methods and audit events, so checks can be repeated and their output attached to tickets.
41. Level 41: Where the Job Stops: Escalation and Evidence Packets
    Learn where first and second line support work ends: which sign-in problems go to third line or to Microsoft, and how to build an evidence packet that someone else can act on without asking for more information.
42. Level 42: Final Challenge: The Sign-in Ticket Queue Exam
    Work through a queue of realistic, mixed Microsoft 365 sign-in tickets that draws on the whole course: triage each one, resolve or escalate it, and write a note for each.

Access

The first 2 levels are free with a free account. Every level, the podcast edition and the AI tutor come with All Access at £4.99/month or any Creator plan — see pricing.

Start free →