Name policies by persona and create every new policy in Report-only first¶
Licence and role
Microsoft Entra ID P1 (included in Microsoft 365 Business Premium, E3 and E5).
Why it matters¶
Policies that are created straight to On are the usual cause of lockouts. Report-only mode evaluates a policy on every sign-in and logs the result without enforcing it, so you see who would be blocked before anyone is. A naming convention (number, persona, app, control) keeps 15+ policies readable.
Steps¶
- Agree a naming convention, for example CA001-AllUsers-AllApps-RequireMFA, CA010-Admins-AllApps-PhishingResistant, CA020-AllUsers-Legacy-Block.
- Run the read-only check to list every policy with its state and last change. Rename existing policies to the convention.
- Rule for the team: every new or edited policy goes to Report-only for at least 7 days, then On after the sign-in log review.
- Use What If (Conditional Access > Policies > What If) for a test user before switching a policy to On.
Impact on users¶
None. Renaming and report-only change nothing for users.
Rollback¶
Nothing to roll back.
Read-only check¶
Reads settings only. It changes nothing in your tenant or on the device.
Modules, connection and role
Requires: Microsoft.Graph PowerShell SDK (Microsoft.Graph.Identity.SignIns, .Reports, .Identity.DirectoryManagement).
Connect first:
Connect-MgGraph -Scopes Policy.Read.All,AuditLog.Read.All,UserAuthenticationMethod.Read.All,Directory.Read.All
Role: Global Reader or Security Reader is enough for these reads.
$p = Get-MgIdentityConditionalAccessPolicy -All
$p | Sort-Object DisplayName | ForEach-Object { "$($_.DisplayName) | $($_.State) | modified: $($_.ModifiedDateTime)" }
$p | Group-Object State | ForEach-Object { "State $($_.Name): $($_.Count)" }
How to verify¶
Every policy follows the naming convention; new policies show state 'enabledForReportingButNotEnforced' for at least 7 days before 'enabled'.
Sources¶
- Concept conditional access report only (Microsoft Learn)
- Howto conditional access insights reporting (Microsoft Learn)
This control is in the Conditional Access Baseline Kit
The free Top 5 has this control with its Jira import, Excel project plan, tracker CSV and the read-only PowerShell script. The Complete kit has all 20 controls.