A user is blocked during Microsoft 365 sign-in after a policy change. Which evidence should the administrator inspect first?

1. An unrelated user's successful sign-in
2. Only the application's marketing page
3. The relevant Entra sign-in event and policy evaluation details
4. Only the user's document count