If you are Fred and you are seeing this, the likely cause is that the sign-in used a different address than the one on the allow-list, or that the Entra registration is not finished. /api/health reports which settings are still missing, without revealing any of them.