This message was deleted.

Did you check aaad.debug? Also any log in Duo or and Azure AD? The only case I got this is when user enter wrong password too many times and again I block on NS before AD lock out. What's the nb of attempts before AD lock out? No real solution just a few ideas

Cannot Complete Request comes from Storefront, you need to look in those logs to see why it's being kicked back.

Thanks guys, I had another login issue that seemed to happen at the same time after auth with a spinning wheel before enumerating SF. I have disabled aaa caching and ensured the affected users got a fresh reset and so far so good. Thanks for the feedback... @CTXMike the errors in the delivery services log on SF reported the account was in fact locked out so hoping thats all it was. Thought Id ask on here, IVe done this type of deployment at least 10 times but this one has been plagued with issues, ta