Conditional Access report-only review log
Free sample from Runbook Foundry · CC BY 4.0 · For Microsoft Entra ID tenants with P1 or higher
Use one copy per policy. Keep the policy in Report-only until every row in the review table has a decision.
Policy name: __________ Created: __________ Owner: __________ Report-only start: __________ Planned enforcement date: __________ (at least 7 to 14 days later)
Pre-checks
- [ ] Two emergency access accounts exist, are tested, and their group is excluded from this policy
- [ ] Service and sync accounts identified and handled deliberately
- [ ] Any Microsoft-managed policy that overlaps with this one has been reviewed
- [ ] Users who'll be affected know what is changing and when
Where to look
- Policy → Policy impact view (24 hours / 7 days / 1 month)
- Entra ID > Monitoring & health > Sign-in logs → open a sign-in → Report-only tab (check interactive and non-interactive sign-ins)
Review table
| Date | User / app / device | Result (Failure / User action required) | Cause | Decision (expected / fix device or app / exclude) | Exclusion owner and review date |
|---|---|---|---|---|---|
Go / no-go
- [ ] No unexplained Report-only: Failure results in the last 7 days
- [ ] Every exclusion has an owner, a reason and a review date (90 days at most)
- [ ] Help desk briefed, including how to issue a Temporary Access Pass
- [ ] Rollback plan: set the policy back to Report-only (don't delete it)
Approved to enforce by: __________ Date: ______ Switched to On at: ______
Templates and guidance only. Validate against current Microsoft documentation. Drafted with AI assistance and reviewed for accuracy. Not affiliated with Microsoft or Google.