Easter Egg: User blocked during Easter - cause and solution

Users being locked out

Over the Easter weekend of 2025, many organizations using Microsoft Entra ID (formerly Azure AD) were caught off guard when a significant number of users were suddenly blocked from accessing corporate resources. The cause? Entra ID categorized these accounts as “high risk” due to “leaked credentials”. Conditional Access Policies blocked these users from attempting access due to the existing risk. In this post, I'll explain what happened, why it happened, and most importantly, provide a simple and secure solution to the problem.

en_GBEnglish