Might be worthwhile to note that AzReject could mean the user is "not authorized", ie, they are not allowed in the user policy, OR the user's current session does not have the proper authentication level for the resource being accessed (even though the user allowed by the user policy).