Conditional Access report-only evaluation

This page's changes and edits · All guidance changes

Microsoft's edit · 27 May 15:45 UTC

Availability and licensing for conditional access

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 21b56e6 · +3 −3 lines · also on GitHub

⋯ 78 unchanged lines

7979 Report-only mode is a valuable tool for validating policy changes progressively before you enforce them. Use the following practices to reduce the risk of unintended access disruptions:

8080

8181 - **Test new policies alongside enforced policies.** Create a new policy in report-only mode while your existing enforced policies remain active. This approach lets you observe what the new policy *would* do without affecting user access. Monitor the report-only results in sign-in logs to confirm the policy behaves as expected before you switch it to an enforced state.

82 −- **Compare outcomes in the Insights workbook.** Use the [Conditional Access Insights and Reporting workbook](howto-conditional-access-insights-reporting.md) to view report-only and enforced policy results side by side for a specific time range, set of applications, and users. This comparison helps you identify where a new policy would change access decisions before those changes take effect.

82 +- **Compare outcomes in the Insights workbook.** Use the [Conditional Access Insights and Reporting workbook](howto-conditional-access-insights-reporting.md) to view report-only and enforced policy results side by side for a specific time range, set of applications, and users. This comparison helps you identify where a new policy would change access decisions before those changes take effect. The workbook requires Microsoft Entra ID P1 and a Log Analytics workspace that's receiving sign-in logs; for details, see the workbook [prerequisites](howto-conditional-access-insights-reporting.md#prerequisites).

8383 - **Validate changes to existing policies.** Before you modify an enforced policy, create a copy in report-only mode with your proposed changes. Compare the report-only copy's results against the original enforced policy to verify the intended effect. When you're satisfied, update the enforced policy and remove the copy.

84 −- **Use AI-assisted phased rollout.** The [Conditional Access Optimization Agent](../../security-copilot/conditional-access-agent-optimization.md) creates suggested policies in report-only mode. You can review the agent's analysis and projected impact before deciding to enforce. For more information, see [Phased rollout with the Conditional Access Optimization Agent](../../security-copilot/conditional-access-agent-optimization-phased-rollout.md).

85 −- **A note on A/B testing.** Conditional Access doesn't support classical A/B testing, which splits live traffic between two enforced variants of a policy. The closest native equivalent is the [Optimization Agent's phased rollout](../../security-copilot/conditional-access-agent-optimization-phased-rollout.md), which gradually applies a new policy to ordered groups while keeping the original report-only policy intact, so you can compare outcomes between cohorts before full enforcement.

84 +- **Use AI-assisted phased rollout.** Where available, the [Conditional Access Optimization Agent](../../security-copilot/conditional-access-agent-optimization.md) creates suggested policies in report-only mode. You can review the agent's analysis and projected impact before deciding to enforce. For more information, see [Phased rollout with the Conditional Access Optimization Agent](../../security-copilot/conditional-access-agent-optimization-phased-rollout.md). The agent requires Microsoft Security Copilot with provisioned security compute units (SCUs) and Microsoft Entra ID P1, so it isn't enabled in every tenant; for details, see the agent [prerequisites](../../security-copilot/conditional-access-agent-optimization.md#prerequisites).

85 +- **A note on A/B testing.** Conditional Access doesn't support classical A/B testing, which splits live traffic between two enforced variants of a policy. Where the Optimization Agent is enabled in your tenant, the closest native equivalent is the [Optimization Agent's phased rollout](../../security-copilot/conditional-access-agent-optimization-phased-rollout.md), which gradually applies a new policy to ordered groups while keeping the original report-only policy intact, so you can compare outcomes between cohorts before full enforcement.

8686

8787 > [!NOTE]

8888 > Report-only mode evaluates policies but doesn't enforce grant controls or session controls. Users aren't prompted for multifactor authentication or blocked by report-only policies. Some limitations apply, such as policies that use the **User Actions** scope. For more information, see the [policy evaluation results](#policy-evaluation-results) in this article.

⋯ 4 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:17 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.