A user reports being blocked after a policy rollout. Which evidence is the most direct starting point for identifying the applied Conditional Access decision?

1. A random successful sign-in from a different user
2. The repository's latest commit message only
3. The VM's disk capacity
4. The relevant sign-in log and Conditional Access policy evaluation details