completion:
```json
{"tool_name": "submit_resolution", "arguments": {"resolution": "Review the Conditional Access policy to ensure it only applies to compliant devices. Since contractors use personal laptops, consider allowing conditional access based on Azure AD app registration or use of a specific app. Consult Okta or Azure portal policies for this scenario.", "cited_artifacts": ["KB-00008"], "confidence": 0.8, "escalate": false}}
```

resolution: Review the Conditional Access policy to ensure it only applies to compliant devices. Since contractors use personal laptops, consider allowing conditional access based on Azure AD app registration or use of a specific app. Consult Okta or Azure portal policies for this scenario.


completion:
```json
{"tool_name": "submit_resolution", "arguments": {"resolution": "Review the Conditional Access policy for external contractors. Ensure it does not enforce compliant devices. Consider adding an exception for external contractors using personal laptops. Check for any misconfigured settings that may be causing the policy to block them.", "cited_artifacts": ["KB-00001"], "confidence": 0.75, "escalate": false}}
```

resolution: Review the Conditional Access policy for external contractors. Ensure it does not enforce compliant devices. Consider adding an exception for external contractors using personal laptops. Check for any misconfigured settings that may be causing the policy to block them.


completion:
```json
{"tool_name": "submit_resolution", "arguments": {"resolution": "The issue seems to be related to MFA reset procedures. Refer to KB-00011 for Okta, Google Workspace, and Azure AD/Entra MFA reset procedures. Since the users are locked out, follow the procedure to reset their MFA. Ensure the user is verified via video call or badge scan before proceeding.", "cited_artifacts": ["KB-00011"], "confidence": 0.85, "escalate": false}}
```

resolution: The issue seems to be related to MFA reset procedures. Refer to KB-00011 for Okta, Google Workspace, and Azure AD/Entra MFA reset procedures. Since the users are locked out, follow the procedure to reset their MFA. Ensure the user is verified via video call or badge scan before proceeding.


completion:
```json
{"tool_name": "submit_resolution", "arguments": {"resolution": "Review the Conditional Access policy to ensure it's not unintentionally blocking devices that meet all other criteria (such as compliant devices). Check if there are any misconfigurations or outdated policies that might be causing the issue. Reach out to the users directly for their laptops and understand if they can use a different device that is compliant with the new policy. If necessary, escalate the issue to the appropriate support team.", "cited_artifacts": ["KB-00003", "KB-00011", "KB-00008"], "confidence": 0.85, "escalate": false}}
```

resolution: Review the Conditional Access policy to ensure it's not unintentionally blocking devices that meet all other criteria (such as compliant devices). Check if there are any misconfigurations or outdated policies that might be causing the issue. Reach out to the users directly for their laptops and understand if they can use a different device that is compliant with the new policy. If necessary, escalate the issue to the appropriate support team.


completion:
```json
{"tool_name": "submit_resolution", "arguments": {"resolution": "Review and update the Conditional Access policy to allow personal laptops for EU contractors. Ensure the policy is configured to allow MFA but does not enforce device compliance for external users.", "cited_artifacts": ["KB-00011"], "confidence": 0.85, "escalate": false}}
```

resolution: Review and update the Conditional Access policy to allow personal laptops for EU contractors. Ensure the policy is configured to allow MFA but does not enforce device compliance for external users.


completion:
```json
{"tool_name": "submit_resolution", "arguments": {"resolution": "Review the Conditional Access policy to ensure it includes an exception for external contractors using personal laptops. Update the policy to allow for this scenario without MFA. Reach out to the relevant Okta or Entra admin for policy modification.", "cited_artifacts": ["KB-00011"], "confidence": 0.8, "escalate": false}}
```

resolution: Review the Conditional Access policy to ensure it includes an exception for external contractors using personal laptops. Update the policy to allow for this scenario without MFA. Reach out to the relevant Okta or Entra admin for policy modification.


completion:
```json
{"tool_name": "submit_resolution", "arguments": {"resolution": "Review the Conditional Access policy to ensure it allows access to external contractors. Consult the runbook provided in KB-00011 for MFA reset procedures. If the issue persists, check Active Directory authentication failures by reviewing Event ID logs and following the steps in KB-00008.", "cited_artifacts": ["KB-00011", "KB-00008"], "confidence": 0.85, "escalate": false}}
```

resolution: Review the Conditional Access policy to ensure it allows access to external contractors. Consult the runbook provided in KB-00011 for MFA reset procedures. If the issue persists, check Active Directory authentication failures by reviewing Event ID logs and following the steps in KB-00008.


completion:
```json
{"tool_name": "submit_resolution", "arguments": {"resolution": "Review the Conditional Access policy to ensure it does not mistakenly block external contractors. The policy likely requires a compliant device. Since contractors use personal laptops, these devices do not need to be enrolled in Intune. Investigate if the policy includes specific device compliance requirements and adjust accordingly. Reach out to your security team for guidance on configuring the policy to allow personal devices for contractors.", "cited_artifacts": ["KB-00008"], "confidence": 0.85, "escalate": false}}
```

resolution: Review the Conditional Access policy to ensure it does not mistakenly block external contractors. The policy likely requires a compliant device. Since contractors use personal laptops, these devices do not need to be enrolled in Intune. Investigate if the policy includes specific device compliance requirements and adjust accordingly. Reach out to your security team for guidance on configuring the policy to allow personal devices for contractors.