The remote NGC session was denied.

Extraordinaire20 

Hi Both, We have recently run into the same issue and had a chat with MS after reviewing our conditional access policies for possible denies as the connection that was denied came from a TOR exit node with no Geo location. The actual reference in this instance to NGC is actually referring to Next Generation Credentials, like passwordless authentication. The error is not related to a conditional access policy, including one targeting a GeoCoordinate setting.

 
This sign-in refers to passwordless authentication using the Microsoft Authenticator app, for example. An 1003033 error occurs when a user attempts to authenticate with the tenant that sent an authentication request to the registered Microsoft Authenticator app, and the error signifies that the user manually denied the authentication request in the Microsoft Authenticator app.