Conditional Access report-only evaluation
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit b94923e · +14 −13 lines · also on GitHub
11
---
2
−title: Analyze Conditional Access policy impact
3
−description: Analyze Conditional Access policy impact using report-only mode and other tools.
2
+title: "Conditional Access Policy Insights: Monitoring and Evaluation"
3
+description: Discover how to analyze Conditional Access policy results with tools like Azure Monitor and insights workbooks for better policy management.
44
ms.service: entra-id
55
ms.subservice: conditional-access
66
ms.topic: article
7
−ms.date: 03/12/2025
7
+ms.date: 09/15/2025
88
ms.author: joflore
99
author: MicrosoftGuyJFlo
1010
manager: dougeby
1111
ms.reviewer: kvenkit
1212
ms.custom: sfi-image-nochange
1313
---
14
+
1415
# Analyze Conditional Access Policy Impact
1516
16
−Conditional Access helps organizations stay secure by applying the right security access controls under the right circumstances. Understanding the impact of these policies can be challenging, especially when deploying new policies. This article explains how to analyze Conditional Access policy impact using report-only mode and other tools.
17
+Conditional Access helps organizations stay secure by applying the appropriate security access controls in the right circumstances. Understanding the impact of these policies is challenging, especially when deploying new policies. This article explains how to analyze the impact of Conditional Access policies using report-only mode and other tools.
1718
18
−There are several options available to administrators based on report-only mode. Report-only mode is a policy state letting administrators test most Conditional Access policies before enabling them.
19
+Administrators have several options based on report-only mode. Report-only mode is a policy state that lets administrators test most Conditional Access policies before enabling them.
1920
20
−- Conditional Access policies can be evaluated in report-only mode except for items included in the "User Actions" scope.
21
−- During sign-in, policies in report-only mode are evaluated but not enforced.
21
+- Administrators can evaluate Conditional Access policies in report-only mode, except for items included in the "User Actions" scope.
22
+- During sign-in, the system evaluates policies in report-only mode but doesn't enforce them.
2223
- Results are logged in the **Conditional Access** and **Report-only** tabs of the Sign-in log details.
2324
- Customers with an Azure Monitor subscription can monitor the impact of their Conditional Access policies using the Conditional Access insights workbook.
2425
2526
> [!WARNING]
26
−> Policies in report-only mode that require a compliant device might prompt users on macOS, iOS, and Android devices to select a device certificate during policy evaluation, even though device compliance isn't enforced. These prompts might repeat until the device is compliant. To prevent end users from receiving prompts during sign-in, exclude device platforms Mac, iOS, and Android from report-only policies that perform device compliance checks.
27
+> Policies in report-only mode that require a compliant device can prompt users on macOS, iOS, and Android devices to select a device certificate during policy evaluation, even though device compliance isn't enforced. These prompts can repeat until the device is compliant. To prevent end users from receiving prompts during sign-in, exclude the Mac, iOS, and Android device platforms from report-only policies that perform device compliance checks.
2728
2829
<a name='policy-results'></a>
2930
⋯ 17 unchanged lines
4748
4849
- Workbooks
4950
- Sign-in logs
50
−- Policy impact (Preview)
51
+- Policy impact (preview)
5152
5253
<a name='policy-impact-preview'></a>
5354
### Policy impact
5455
55
−The policy impact view of Conditional Access lets admins with at least the Security Reader role see a snapshot of information about the potential or existing impacts of policies on interactive sign-ins in your organization. This functionality lets you explore impact over a period of the past 24 hours, 7 days, or 1 month. Additionally, you can see and link to a sampling of sign-in events for further detail.
56
+The policy impact view of Conditional Access lets admins with at least the Security Reader role see a snapshot of the potential or existing impacts of policies on interactive sign-ins in your organization. You can explore the impact over the past 24 hours, 7 days, or 1 month. You can also see and link to a sampling of sign-in events for more details.
5657
5758
:::image type="content" source="media/concept-conditional-access-report-only/policy-impact-example-report-only.png" alt-text="Screenshot of Conditional Access policy impact example." lightbox="media/concept-conditional-access-report-only/policy-impact-example-report-only.png":::
5859
⋯ 1 unchanged line
6061
6162
### Workbooks
6263
63
−Administrators can create multiple policies in report-only mode, so it's necessary to understand both the individual impact of each policy and the combined impact of multiple policies evaluated together. The [Conditional Access Insights and Reporting workbook](howto-conditional-access-insights-reporting.md) lets administrators visualize Conditional Access policy, it queries and monitor the impact of a policy for a given time range, set of applications, and users. Administrators can customize workbooks to suit their specific needs.
64
+Administrators can create multiple policies in report-only mode, so it's important to understand both the individual impact of each policy and the combined impact of multiple policies evaluated together. The [Conditional Access Insights and Reporting workbook](howto-conditional-access-insights-reporting.md) lets administrators visualize Conditional Access policies, query and monitor the impact of a policy for a specific time range, set of applications, and users. Administrators can customize workbooks to meet their needs.
6465
6566
### Sign-in logs
6667
67
−For deeper evaluation of Conditional Access policies and their application at a specific sign-in, administrators might investigate individual sign-in events. Each of these events includes details of what Conditional Access policies were enabled versus were in report-only mode, and applied or didn't apply.
68
+For deeper evaluation of Conditional Access policies and their application at a specific sign-in, administrators might investigate individual sign-in events. Each event includes details about which Conditional Access policies were enabled, in report-only mode, applied, or not applied.
6869
6970
7071
⋯ 4 unchanged lines
7576
7677
## Related content
7778
78
−- [Configure report-only mode on a Conditional Access policy](howto-conditional-access-insights-reporting.md)
79
+- Learn how to [configure report-only mode on a Conditional Access policy](howto-conditional-access-insights-reporting.md).
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:17 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.