M365 Conditional Access Policies are written in isolation and evaluated as a set

Every sign-in is scored against every enabled policy simultaneously. But the admin console shows you one policy at a time, change control approves one policy at a time, and the person making the change is thinking about one problem at a time. That asymmetry is the root of most Conditional Access incidents.

A policy is rarely wrong on its own terms. It becomes wrong because something else changed—an exclusion added elsewhere, a role reassigned, a scope narrowed—and nobody re-evaluated the whole set.

After any change, stop asking “Did I break this policy?” and start asking “What still applies to this person?” Enumerate every enabled policy against the identity you touched. That enumeration is the coverage trace, and it takes about ten minutes:

1. Go to Entra ID > Conditional Access > Policies > What If.
2. Configure test parameters (such as User, Target Cloud App, Device Platform, and Client App).
3. Run the evaluation to generate a breakdown of Policies that will apply versus Policies that will not apply (along with the specific reason a policy was skipped).