Paste the error.
Get the next move.

Operational context

Use the error as evidence, not as the diagnosis

Microsoft 365 administration errors often describe the layer that rejected a request rather than the configuration that caused it. An Entra sign-in code can point to Conditional Access, account state, consent, or token claims. A Microsoft Graph response can reflect the resource path, permission type, tenant policy, throttling, or a stale object. Intune and Exchange errors add their own service-specific evidence.

Start with the exact code, HTTP status, correlation ID, request ID, and UTC timestamp. Use this decoder to translate the signal into a short list of checks, then confirm the answer in the affected tenant. Preserve the original error before retrying so a successful retry does not erase the evidence needed for a root-cause review.

What to capture before escalation

• The complete error text and service that produced it
• Tenant, account, application, and resource context without secrets
• Correlation and request identifiers with the UTC failure time
• The permission, policy, or enrollment change made immediately before the failure

This reference does not inspect your tenant or replace Microsoft service health, sign-in logs, audit logs, or support. It is designed to help an administrator reach those sources with a focused hypothesis instead of a generic search.