How to output affected users for conditional access (report-only mode)

BCAzure01 25 Reputation points
2025-10-07T05:18:58.0666667+00:00

I configured conditional access to block access to the Microsoft Admin Portals in the EntraID Center (report-only mode).

I would like to output all affected users in a report for the past week.

How can I output results by narrowing down the relevant policy names, policy IDs, and time period?

[Investigation Status]

  1. I tried to get an overview using "Policy Impact (Preview)" in the GUI, but I couldn't see the full amount with only sample logs.
  2. Check individual events in the sign-in log.

I tried to output the evaluation results (failed) from the Entra ID > Monitoring and Health > Sign-in Logs > Filter > Conditional Access tab, but the data volume was too large to extract the JSON file.

Microsoft Security | Microsoft Entra | Other
0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.