entra1-1  Exercise 1: Map the Fabrikam Problem
==============================================

THE SCENARIO
------------
Fabrikam Ltd's staff use "Sign in with Microsoft" on Acme Support Desk (your
product). It started failing for everyone at Fabrikam last week. Contoso, another
client, is unaffected.

THE MAP
-------
Identity provider:    Microsoft Entra ID.
The tenant:           Fabrikam's own Entra tenant. (Contoso signs in against its
                      own, separate tenant.)
Relying party:        Acme Support Desk. It doesn't check passwords itself; it
                      hands the sign-in to Fabrikam's tenant and trusts the signed
                      answer.
Authentication:       Happens in Fabrikam's tenant: the user proves who they are
                      (password, MFA, any policy checks).
Authorization:        Two layers. Fabrikam's tenant decides whether the user may
                      be sent on to Acme Support Desk at all; Acme Support Desk
                      then decides what that user may do inside the product.
What carries the
answer back:          Signed tokens (or a signed assertion). Chapter 3 covers them.

WHAT THE EVIDENCE TELLS YOU
---------------------------
  - Everyone at Fabrikam is affected at the same moment: the fault is something
    shared by all of Fabrikam's sign-ins, not one user's account or password.
  - Contoso is fine: Acme Support Desk as a whole, and Microsoft's service, are
    working. The fault sits in something specific to Fabrikam's tenant, or in the
    connection between Fabrikam's tenant and your system.

THREE CAUSES THAT FIT
---------------------
  1. A credential used by the connection has expired (a client secret, a
     certificate, or a similar item). It stops working for every Fabrikam user at
     once. This is the case this course is built around.
  2. The integration object for Acme Support Desk in Fabrikam's tenant was
     changed or removed: for example permissions withdrawn, user assignment
     changed, or the application deleted.
  3. A new policy in Fabrikam's tenant (for example a Conditional Access rule)
     blocks sign-in to this application, even though the integration itself is
     healthy.

Other reasonable answers: a setting copied across incorrectly on your side after a
change (the two ends no longer match); Fabrikam's domain or tenant details
changed. A Microsoft service outage is unlikely here, since Contoso still works.

HOW YOU WOULD CONFIRM
---------------------
You do not know which cause it is yet, and should not guess. The sign-in logs
(Chapter 7) and the integration's page in the portal (Chapter 5) are where you
get the evidence.

WHY THIS WORKS AS AN ANSWER
---------------------------
It uses the one-client-one-tenant idea to turn "it's broken" into a narrower
question ("what is different about Fabrikam's tenant or its connection?"), and
lists causes without choosing one before there's evidence.