Additional Microsoft Entra services and features related to identity, access, and network security
How to output affected users for conditional access (report-only mode)
BCAzure01
25
Reputation points
I configured conditional access to block access to the Microsoft Admin Portals in the EntraID Center (report-only mode).
I would like to output all affected users in a report for the past week.
How can I output results by narrowing down the relevant policy names, policy IDs, and time period?
[Investigation Status]
- I tried to get an overview using "Policy Impact (Preview)" in the GUI, but I couldn't see the full amount with only sample logs.
- Check individual events in the sign-in log.
I tried to output the evaluation results (failed) from the Entra ID > Monitoring and Health > Sign-in Logs > Filter > Conditional Access tab, but the data volume was too large to extract the JSON file.
Microsoft Security | Microsoft Entra | Other
Microsoft Security | Microsoft Entra | Other
Sign in to answer