How do I acquire logs for device being blocked from Outlook account

Hi @Chris Weatherford,

Welcome to the Microsoft Q&A forum

I would like to provide you with the following information:

Since your Outlook account is a business account, it is managed and configured by the tenant’s administrators.

To retrieve Outlook sign‑in logs for a company account, the account must have the appropriate administrator permissions in the tenant. Without these permissions, the sign‑in logs cannot be accessed.

In many organizations, there are also security policies that restrict accounts to sign in only within the office network or the company’s internal environment.

In this case, you can follow the steps below to check the sign‑in logs:

Note: The steps below require administrator permissions in the tenant. If you do not have admin access, please contact your organization’s IT department for assistance.

Step 1: Go to entra.microsoft.com

Step 2: Select Users > All users, then find and select your account

Step 3: Select Sign‑in logs

Here, you will be able to view the sign‑in activity for the account, including both successful and failed sign‑in attempts, along with the detailed reasons.

I hope this information is helpful. Please follow these steps and let me know if it works for you. If not, we can work together to resolve this.

Thank you for your patience and your understanding. If you have any questions or need further assistance, please feel free to share them in the comments on this post so I can continue to support you.

I look forward to continuing the conversation.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

For a device that is blocked from accessing an Outlook (Microsoft 365) account, the most relevant logs are:

1. Outlook client logs on the PC
2. Microsoft 365 audit/enriched logs (if enabled and accessible by the organization’s admin)

Because this is a company Outlook account, coordinate with the organization’s IT or security admin to collect both sides.

1. Collect Outlook client logs from the blocked PC

If Outlook was installed and used on the PC before it was blocked, Outlook troubleshooting logs can show connectivity, Autodiscover, and authentication behavior around the time access stopped.

Enable Outlook logging (if not already enabled)

For Outlook 2016/2013/2010 on Windows:

1. Open Outlook.
2. Go to File → Options → Advanced.
3. Under Other, select Enable troubleshooting logging.
4. Select OK and restart Outlook.

If Outlook cannot start or a new profile is being tested, logging can also be enabled via the registry as described in the article, but that should be done only by IT and with a registry backup.

Reproduce the issue and close Outlook

1. Attempt to connect/sign in so the failure is captured.
2. Close Outlook completely so diagnostic data is flushed to disk.

Retrieve the Outlook log files

1. Open File Explorer.
2. In the address bar, enter %temp% and press Enter.
3. Open the Outlook Logging folder.
4. Sort by Date modified.
5. Copy the most recent Outlook*.etl file to a temporary folder (for example, Desktop). Compress it to .zip if needed before sharing with IT or Microsoft.

These logs help IT or Microsoft support see when and how Outlook connectivity started failing.

2. Check Outlook connection and Autodiscover status

If Outlook can still be opened but is blocked at the service level, the connection and Autodiscover tools can show status and errors.

Outlook Connection Status

1. In Windows, locate the Outlook icon in the taskbar notification area.
2. Hold Ctrl and right‑click the Outlook icon.
3. Select Connection Status.
4. Expand all columns and take screenshots (scroll horizontally to capture all columns).
5. Provide these screenshots to IT or support.

Test Email AutoConfiguration (Autodiscover)

1. Hold Ctrl and right‑click the Outlook icon in the taskbar.
2. Select Test Email AutoConfiguration.
3. Enter the mailbox email address if needed.
4. Clear Use Guessmart and Secure Guessmart Authentication.
5. Select Test.
6. After completion, capture screenshots of the Results, Log, and XML tabs (scroll as needed) and share with IT.

These outputs help determine whether the block is due to Autodiscover, policy, or other service‑side conditions.

3. Use Microsoft 365 enriched logs (admin task)

If the organization uses Global Secure Access and has enabled enriched Microsoft 365 logs, the Microsoft 365 audit logs can show when the device started being blocked and why.

An admin can:

1. Access the Microsoft 365 audit logs that are enriched by Global Secure Access.
2. Review entries related to Outlook/Microsoft 365 access for the user and device.
3. Use the enriched properties (device ID, OS, original IP address) to identify the blocked device and the time and reason access was denied.

These enriched logs provide network diagnostic data, performance data, and security events relevant to Microsoft 365 apps, including Outlook, and are the authoritative source for when a device was blocked at the service or network layer.

4. If the device is Intune‑managed

If the PC is enrolled in Intune and the block is due to device compliance or management policy, device management logs can be exported from Windows and sent to IT:

1. Open Settings on the PC.
2. Go to Accounts → Access work or school.
3. Select Export your management log files.
4. Logs are saved under C:\Users\Public\Public Documents\MDMDiagnostics.
5. Provide both generated files to the IT admin.

These logs help IT see policy or compliance issues that might cause Outlook access to be blocked.

In summary, to see when and how the block occurred, combine: Outlook client logs and status from the PC, Microsoft 365 audit/enriched logs from the tenant, and (if applicable) Intune management logs from the device.

References:

• Enable and collect Outlook logs to troubleshoot profile creation issues
• What is the Enable logging (troubleshooting) option?
• How to use the Global Secure Access enriched Microsoft 365 logs
• Report a device problem for Windows