Pilot a Microsoft Entra Conditional Access MFA Policy

This walkthrough creates a Conditional Access policy for a dedicated test group, evaluates it in report-only mode, and reviews real sign-in results before any enforcement decision. It does not replace or modify an existing MFA policy.

Do not turn off your current protection to follow this guide

Conditional Access requires Microsoft Entra ID P1 or P2, or an eligible trial, and a Conditional Access Administrator role to create policies. Security defaults and Conditional Access are not designed to run together. If your tenant uses security defaults, do not disable them just to try this tutorial; plan a supported replacement in a tenant you control first.

Report-only mode evaluates without enforcing

A report-only policy does not require MFA or block sign-ins. A sign-in can still receive an MFA prompt from another enabled policy or security defaults, so inspect this policy’s own report-only result in the sign-in details.

01

Confirm the Tenant, License, and Pilot Plan

Preflight

Use a tenant where you are authorized to manage Conditional Access. Confirm the license and admin role, review current MFA and Conditional Access policies, and choose a non-administrator test user. The account should already be able to complete the MFA method your organization permits.

Tenant and tenant ID:
Conditional Access license and admin role confirmed:
Pilot user and test group:
Emergency access accounts identified:
Existing policies and security defaults reviewed:

❯ Illustrative Output (Results Vary)

Proceed only when the pilot group is approved and the current protections are understood.

---

02

Verify the Pilot Group and Test Account

Scope

In the Microsoft Entra admin center, open Entra ID > Groups > All groups and confirm the approved pilot group contains only the intended test users. Check that emergency access accounts and production administrators are not members. Use an existing approved group rather than targeting all users for this pilot.

Pilot group: CA-MFA-Pilot-Users (example name only)
Test account: standard, non-administrator user
Scope: pilot users only
Emergency access accounts: outside the pilot group

❯ Illustrative Output (Results Vary)

The test user is in scope; unrelated users and emergency access accounts are not.

---

03

Create the MFA Policy in Report-Only Mode

Policy Setup

Go to Entra ID > Conditional Access > Policies and create a policy named, for example, CA-Pilot-Require-MFA. Under Users or workload identities, include the pilot group and exclude your emergency access accounts. Under Target resources > Resources, select All resources. Under Access controls > Grant, require multifactor authentication. Set Enable policy to Report-only before saving.

Include: approved pilot group
Exclude: emergency access accounts
Target resources: All resources
Grant: Require multifactor authentication
Enable policy: Report-only

❯ Illustrative Output (Results Vary)

Confirm the policy shows Report-only and the assignments match the reviewed pilot plan.

Keep exclusions when the policy is enforced

Emergency access accounts do not need to be excluded for report-only evaluation, but Microsoft’s guidance recommends excluding them from policies that restrict sign-in. Keep the exclusion in place if you later enable this policy.

---

04

Simulate the Policy with What If

Pre-Enforcement Check

Open Entra ID > Conditional Access > Policies > What If. Select the test identity, target resource, device platform, and client app, then run the evaluation. The tool includes enabled and report-only policies in its results. It helps confirm whether the policy matches the test conditions, but it does not perform a real sign-in or MFA challenge.

Identity: the pilot test user
Target resource: the resource selected for the test
Device platform: the test device platform
Client app: the client used for the test

❯ Illustrative Output (Results Vary)

The new policy appears in the evaluation with the expected included or excluded result.

---

05

Run a Real Test Sign-In and Read Its Result

Report Review

Have the test user sign in to the selected resource from the intended device and client. Then open Entra ID > Monitoring & health > Sign-in logs, select that event, and inspect its Conditional Access or Report-only details. Match the policy name, user, resource, time, and result. A report-only result describes what the policy would do; the overall sign-in result can be affected by other policies.

Record the event time and test identity.
Open the matching sign-in event.
Review this policy's report-only result and the grant-control details.
Compare with any other applied Conditional Access policies.

❯ Illustrative Output (Results Vary)

Confirm the expected test sign-ins match the policy and identify any unexpected result before rollout.

Review failures before enabling enforcement

A report-only failure means the policy’s controls would not have been satisfied for that event; it does not mean report-only blocked the sign-in. Check the user’s registered methods, the sign-in context, and the policy’s assignments before changing the policy.

---

06

Approve, Enforce, and Monitor the Pilot

Controlled Rollout

After the owner reviews representative sign-ins and approves the change, open the policy and change Enable policy from Report-only to On for the pilot group. Keep the emergency access exclusions, communicate the expected MFA experience, and monitor new sign-in events. If the policy behaves unexpectedly, return this policy to report-only or turn it off under the approved rollback plan; do not alter unrelated policies.

Change approval and rollout window:
Pilot users and support contact:
Emergency access sign-in verified:
Post-enforcement sign-in review:
Rollback owner and action:

❯ Illustrative Output (Results Vary)

Expand the scope only after pilot sign-ins and support outcomes meet the approved criteria.

Upstream references

See Microsoft’s Conditional Access planning guide, require MFA with Conditional Access, What If tool, report-only insights and reporting, and emergency access account guidance.