An IT administrator is creating a new Microsoft Entra Conditional Access policy to enforce additional security controls for users accessing cloud applications. Before fully enforcing the policy and potentially disrupting user sign-ins, the administrator wants to evaluate and monitor the impact of the policy decisions without actually blocking access or prompting users. Which state should the administrator select for the policy toggle during creation?

Report-only: ### What Report-only Mode Is **Report-only mode** is a policy state in **Microsoft Entra Conditional Access** that evaluates policy conditions and logs the hypothetical outcome of policy evaluations without enforcing grant or block access controls. ### How It Meets the Requirement By setting the **Enable policy** toggle to **Report-only**, administrators can observe and log how the policy would behave across real-time user sign-in events. It records the simulated results directly in sign-in logs and reporting workbooks, enabling organizations to verify that the policy targets the intended users and applications without blocking legitimate activity or generating unexpected prompts. ### Key Advantages and Capabilities - **Zero user impact**: Users are neither prompted for additional requirements nor blocked during evaluation. - **Sign-in log visibility**: Administrators can review sign-in logs to see if a policy would have resulted in **Success**, **Failure**, or **Not Applied**. - **Impact assessment**: Simplifies monitoring policy scope and prevents unintended lockouts across production environments. - **Safe transition path**: Allows administrators to confidently shift the policy toggle from **Report-only** to **On** once results are validated. ### Why This Is Optimal Starting in **Report-only** mode aligns directly with best practices for testing and monitoring Conditional Access policies, providing measurable insights before active enforcement.