Created by Claude - please verify

CA blocks - one row per policy and app; a sign-in failed by two policies counts under both.

Required Microsoft Graph permissions

AuditLog.Read.All — application permission, granted to the app registration with admin consent.

Licence: Microsoft Entra ID P1.

Endpoint: GET /beta/auditLogs/signIns (7 days)

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Conditional Access Blocks by App & Policy

What Conditional Access blocked in the last 7 days, by policy and application - the first question when users say 'I can't get into X'. A sudden jump for one policy usually means a misconfiguration; a steady stream from one app can mean an attack being stopped.

Conditional Access blocked no interactive sign-ins in the last 7 days.