Report-only mode
Report-only mode is a Microsoft Entra Conditional Access policy state that evaluates supported policies during sign-in and records their results without enforcing their grant or session controls. It helps administrators assess potential impact before enabling enforcement.
Read the policy result separately from the sign-in result
A report-only policy evaluates a sign-in without enforcing its controls. Other enabled policies can still block the same attempt.
The result labels have specific meanings:
- Failure: the policy applied, but its required non-interactive grant or session controls were not all satisfied. This policy did not block the sign-in.
- User action required: satisfying the controls would require an interaction, such as an MFA challenge. Report-only evaluation does not prompt for that challenge.
- Not applied: the sign-in did not meet the policy’s conditions, perhaps because the user was excluded.
- Success: the policy applied and its required controls were already satisfied. Another policy may still block access.
Microsoft excludes policies scoped to User Actions from report-only support. It also documents a practical exception to a silent rollout: compliant-device policies can cause device-certificate selection prompts on macOS, iOS, and Android even though compliance is not enforced.
Before enabling the policy
Review a period that covers the users and applications the policy is meant to affect. Keep the evaluated settings with the sign-in records, including scope and exclusions, so a later configuration change does not obscure what you tested.
After enabling enforcement, check fresh sign-ins and their outcomes. Report-only results describe the earlier evaluation; they cannot confirm that the later enforcement worked.