Report-only first

I don't enforce a Conditional Access policy until it has run in report-only mode and I've read what it would have done. This is the longer version of Sheet 06: the results to read, the four stages every policy I built went through, and two details that catch people.

What report-only does

Report-only evaluates the policy during sign-in and logs the result without enforcing it. It works for most policies, but not for ones scoped to user actions.

Open any sign-in, go to the Report-only tab, and each policy shows one of four results:

• Success
• Failure
• User action required
• Not applied

Four stages

1. 01Report-only, scoped to the real target population.
2. 02Read the results across a full business cycle. Failure and User action required are where the surprises are: a service account, a legacy client, a vendor on an unmanaged laptop.
3. 03Enforce for a pilot group that includes IT, with the emergency access accounts excluded.
4. 04Enforce for everyone, then watch the Conditional Access tab for the first week.

Two details that catch people

Report-only still runs the first phase of evaluation. Microsoft notes that report-only policies requiring a compliant device can prompt macOS, iOS, and Android users to pick a device certificate. Exclude those platforms from report-only compliance policies. Sheet 07 covers the two phases.

The Conditional Access insights and reporting workbook needs Entra ID P1, sign-in logs flowing to a Log Analytics workspace, and at least Security Reader plus Log Analytics workspace Contributor to read it. Set it up before you need it.

How long do your policies sit in report-only before you flip them?