Conditional Access report-only evaluation
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit c6a530b · +1 −1 lines · also on GitHub
⋯ 78 unchanged lines
7979
Report-only mode is a valuable tool for validating policy changes progressively before you enforce them. Use the following practices to reduce the risk of unintended access disruptions:
8080
8181
- **Test new policies alongside enforced policies.** Create a new policy in report-only mode while your existing enforced policies remain active. This approach lets you observe what the new policy *would* do without affecting user access. Monitor the report-only results in sign-in logs to confirm the policy behaves as expected before you switch it to an enforced state.
82
−- **Compare outcomes in the Insights workbook.** Use the Insights and Reporting workbook in [Analyze Conditional Access policy impact](howto-conditional-access-insights-reporting.md) to view report-only and enforced policy results side by side for a specific time range, set of applications, and users. This comparison helps you identify where a new policy would change access decisions before those changes take effect.
82
+- **Compare outcomes in the Insights workbook.** Use the [Conditional Access Insights and Reporting workbook](howto-conditional-access-insights-reporting.md) to view report-only and enforced policy results side by side for a specific time range, set of applications, and users. This comparison helps you identify where a new policy would change access decisions before those changes take effect.
8383
- **Validate changes to existing policies.** Before you modify an enforced policy, create a copy in report-only mode with your proposed changes. Compare the report-only copy's results against the original enforced policy to verify the intended effect. When you're satisfied, update the enforced policy and remove the copy.
8484
- **Use AI-assisted phased rollout.** The [Conditional Access Optimization Agent](../../security-copilot/conditional-access-agent-optimization.md) creates suggested policies in report-only mode. You can review the agent's analysis and projected impact before deciding to enforce. For more information, see [Phased rollout with the Conditional Access Optimization Agent](../../security-copilot/conditional-access-agent-optimization-phased-rollout.md).
8585
- **A note on A/B testing.** Conditional Access doesn't support classical A/B testing, which splits live traffic between two enforced variants of a policy. The closest native equivalent is the [Optimization Agent's phased rollout](../../security-copilot/conditional-access-agent-optimization-phased-rollout.md), which gradually applies a new policy to ordered groups while keeping the original report-only policy intact, so you can compare outcomes between cohorts before full enforcement.
⋯ 7 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:17 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.