Conditional Access report-only evaluation

This page's changes and edits · All guidance changes

Microsoft's edit · 16 May 23:03 UTC

Initial changes from test 02

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 7b90c30 · +12 −0 lines · also on GitHub

⋯ 72 unchanged lines

7373

7474 [!INCLUDE [conditional-access-report-only-mode](../../includes/conditional-access-report-only-mode.md)]

7575

76 +## Compare and validate policies before enforcement

77 +

78 +Report-only mode is a valuable tool for validating policy changes progressively before you enforce them. Use the following practices to reduce the risk of unintended access disruptions:

79 +

80 +- **Test new policies alongside enforced policies.** Create a new policy in report-only mode while your existing enforced policies remain active. This approach lets you observe what the new policy *would* do without affecting user access. Monitor the report-only results in sign-in logs to confirm the policy behaves as expected before you switch it to an enforced state.

81 +- **Compare outcomes in the Insights workbook.** Use the [Conditional Access Insights and Reporting workbook](howto-conditional-access-insights-reporting.md) to view report-only and enforced policy results side by side for a specific time range, set of applications, and users. This comparison helps you identify where a new policy would change access decisions before those changes take effect.

82 +- **Validate changes to existing policies.** Before you modify an enforced policy, create a copy in report-only mode with your proposed changes. Compare the report-only copy's results against the original enforced policy to verify the intended effect. When you're satisfied, update the enforced policy and remove the copy.

83 +- **Use AI-assisted phased rollout.** The [Conditional Access Optimization Agent](../../security-copilot/conditional-access-agent-optimization.md) creates suggested policies in report-only mode. You can review the agent's analysis and projected impact before deciding to enforce. For more information, see [Phased rollout with the Conditional Access Optimization Agent](../../security-copilot/conditional-access-agent-optimization-phased-rollout.md).

84 +

85 +> [!NOTE]

86 +> Report-only mode evaluates policies but doesn't enforce grant controls or session controls. Users aren't prompted for multifactor authentication or blocked by report-only policies. Some limitations apply, such as policies that use the **User Actions** scope. For more information, see the [policy evaluation results](#policy-evaluation-results) in this article.

87 +

7688 ## Related content

7789

7890 - Learn how to [configure report-only mode on a Conditional Access policy](howto-conditional-access-insights-reporting.md).

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:17 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.