Conditional Access report-only evaluation
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit fd25160 · +3 −1 lines · also on GitHub
⋯ 6 unchanged lines
77
ms.date: 03/24/2026
88
ms.reviewer: kvenkit
99
ms.custom: sfi-image-nochange
10
+ai-usage: ai-assisted
1011
---
1112
1213
# Analyze Conditional Access Policy Impact
⋯ 65 unchanged lines
7879
Report-only mode is a valuable tool for validating policy changes progressively before you enforce them. Use the following practices to reduce the risk of unintended access disruptions:
7980
8081
- **Test new policies alongside enforced policies.** Create a new policy in report-only mode while your existing enforced policies remain active. This approach lets you observe what the new policy *would* do without affecting user access. Monitor the report-only results in sign-in logs to confirm the policy behaves as expected before you switch it to an enforced state.
81
−- **Compare outcomes in the Insights workbook.** Use the [Conditional Access Insights and Reporting workbook](howto-conditional-access-insights-reporting.md) to view report-only and enforced policy results side by side for a specific time range, set of applications, and users. This comparison helps you identify where a new policy would change access decisions before those changes take effect.
82
+- **Compare outcomes in the Insights workbook.** Use the Insights and Reporting workbook in [Analyze Conditional Access policy impact](howto-conditional-access-insights-reporting.md) to view report-only and enforced policy results side by side for a specific time range, set of applications, and users. This comparison helps you identify where a new policy would change access decisions before those changes take effect.
8283
- **Validate changes to existing policies.** Before you modify an enforced policy, create a copy in report-only mode with your proposed changes. Compare the report-only copy's results against the original enforced policy to verify the intended effect. When you're satisfied, update the enforced policy and remove the copy.
8384
- **Use AI-assisted phased rollout.** The [Conditional Access Optimization Agent](../../security-copilot/conditional-access-agent-optimization.md) creates suggested policies in report-only mode. You can review the agent's analysis and projected impact before deciding to enforce. For more information, see [Phased rollout with the Conditional Access Optimization Agent](../../security-copilot/conditional-access-agent-optimization-phased-rollout.md).
85
+- **A note on A/B testing.** Conditional Access doesn't support classical A/B testing, which splits live traffic between two enforced variants of a policy. The closest native equivalent is the [Optimization Agent's phased rollout](../../security-copilot/conditional-access-agent-optimization-phased-rollout.md), which gradually applies a new policy to ordered groups while keeping the original report-only policy intact, so you can compare outcomes between cohorts before full enforcement.
8486
8587
> [!NOTE]
8688
> Report-only mode evaluates policies but doesn't enforce grant controls or session controls. Users aren't prompted for multifactor authentication or blocked by report-only policies. Some limitations apply, such as policies that use the **User Actions** scope. For more information, see the [policy evaluation results](#policy-evaluation-results) in this article.
⋯ 4 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:17 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.