Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Conditional Access Report-Only Mode
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An IT administrator is creating a new Microsoft Entra Conditional Access policy to enforce additional security controls for users accessing cloud applications. Before fully enforcing the policy and potentially disrupting user sign-ins, the administrator wants to evaluate and monitor the impact of the policy decisions without actually blocking access or prompting users.
Which state should the administrator select for the policy toggle during creation?
Explanations
Off
Off
What the "Off" State Is
The Off state (or disabled state) completely deactivates a Conditional Access policy within Microsoft Entra ID.
Why It Doesn't Meet the Requirement
When a policy is set to Off, Microsoft Entra ID does not evaluate the policy conditions during sign-in events. As a result, no log data or hypothetical outcome reports are generated, making it impossible to monitor or test the policy's potential impact.
Key Characteristics and Limitations
- Inactive evaluation: The policy rules are completely ignored during authentication.
- No telemetry generated: Does not log simulated access results to sign-in logs.
- Purely dormant: Retains the configuration for future editing without active testing.
This Answer Would Be Correct If
The goal was to completely disable a policy without deleting its configuration from the tenant.
Additional Context
To test policies safely, administrators should select Report-only rather than leaving the policy Off.
Report-only
Report-only
What Report-only Mode Is
Report-only mode is a policy state in Microsoft Entra Conditional Access that evaluates policy conditions and logs the hypothetical outcome of policy evaluations without enforcing grant or block access controls.
How It Meets the Requirement
By setting the Enable policy toggle to Report-only, administrators can observe and log how the policy would behave across real-time user sign-in events. It records the simulated results directly in sign-in logs and reporting workbooks, enabling organizations to verify that the policy targets the intended users and applications without blocking legitimate activity or generating unexpected prompts.
Key Advantages and Capabilities
- Zero user impact: Users are neither prompted for additional requirements nor blocked during evaluation.
- Sign-in log visibility: Administrators can review sign-in logs to see if a policy would have resulted in Success, Failure, or Not Applied.
- Impact assessment: Simplifies monitoring policy scope and prevents unintended lockouts across production environments.
- Safe transition path: Allows administrators to confidently shift the policy toggle from Report-only to On once results are validated.
Why This Is Optimal
Starting in Report-only mode aligns directly with best practices for testing and monitoring Conditional Access policies, providing measurable insights before active enforcement.
Audit
Audit
What the "Audit" Option Is
Audit is an enforcement effect used in Azure Policy to evaluate and track the compliance state of Azure resource configurations without blocking resource deployments.
Why It Doesn't Meet the Requirement
In Microsoft Entra Conditional Access, the policy state toggle provides three specific options: Report-only, On, and Off. "Audit" is not a valid toggle state for enabling a Conditional Access policy.
Key Characteristics and Limitations
- Different service scope: Audit belongs to Azure Policy resource governance rather than Entra ID Conditional Access.
- Invalid toggle option: You cannot select "Audit" under the Enable policy setting in Conditional Access.
- Resource vs. identity focus: Azure Policy governs Azure Resource Manager resources, whereas Conditional Access controls identity and access authentication flows.
This Answer Would Be Correct If
You were configuring an Azure Policy definition rule effect to track non-compliant cloud resource properties without denying the deployment.
Additional Context
While the concept of logging without blocking is similar, Microsoft Entra Conditional Access specifically uses Report-only mode for this purpose.
On
On
What the "On" State Is
The On state immediately activates and enforces the Microsoft Entra Conditional Access policy across all targeted users, cloud applications, and conditions.
Why It Doesn't Meet the Requirement
Setting the policy to On immediately applies grant controls (such as requiring multifactor authentication) or block controls. This fails to meet the requirement because the administrator wants to evaluate and monitor policy impact before actively enforcing rules or disrupting user sign-in workflows.
Key Characteristics and Limitations
- Immediate enforcement: All policy rules and access restrictions execute in real time.
- Potential disruption: Incorrectly configured policies in the On state can lock users out of critical resources.
- No trial observation: Does not allow passive monitoring without real-time enforcement.
This Answer Would Be Correct If
The administrator had already tested and validated the policy results and was ready to enforce access controls across production workloads.
Additional Context
Best practice dictates keeping new or significantly updated Conditional Access policies in Report-only mode prior to switching the toggle to On.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra Sign-in Logs Conditional Access
Describe Microsoft Entra Conditional Access
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra Conditional Access
Describe Microsoft Entra Conditional Access
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Conditional Access Signals
Describe Microsoft Entra Conditional Access
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Availability Zones Synchronous Replication
Describe Azure datacenters
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Manager Templates
Describe the benefits of manageability in the cloud
ExpertAZ-305 Designing Microsoft Azure Infrastructure Solutions Exam
Azure Monitor Cost Optimization Design
Recommend a monitoring solution
Last updated Validated