A conditional access policy requires compliant devices while cross-tenant claims are minted by the wrong tenant context during a failover rehearsal

The rule is correct in principle and one federated identity path never carries the expected compliance signal. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.