conditional policies review

Question

conditional policies review

Khalid Hakim 0

Hello, I created few conditional policies for user sign in and risky users. looking for 2nd review by Microsoft support to make sure its working

Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator

2026-05-11T02:37:37.92+00:00
Hello Khalid Hakim

Thank you for reaching out to Microsoft Q&A.

It sounds like you’ve stood up both a sign-in risk policy and a user-risk policy and you’d like us to review your settings and confirm they’re firing correctly. Here’s what you can do (and what I’d check) to make sure everything’s working as expected:

Validate policy configuration • Licensing & role – make sure you’ve got Entra ID P2 (or Suite) and you’re signed in as a Conditional Access Administrator or Security Administrator. • Separate policies – one policy targeting real-time sign-in risk (Medium/High) and a second one targeting aggregated user risk (High). • Assignments – include the right user/group scope (avoid locking out break-glass accounts) and target the intended cloud apps (often “All cloud apps”). • Grant controls – for sign-in risk require MFA (or phishing-resistant strength), for user risk require risk remediation (MFA + password change) or block. • Report-only first – if you’re still in Report-only mode, that’s great; it lets you evaluate impact before enforcing.

Test with the “What If” tool In the Entra admin center go to Conditional Access > What If. Select a test user, choose the apps and conditions (e.g. simulate “Medium” sign-in risk), and confirm the policy you expect is shown as “Would apply.”

Simulate risk events Under Entra ID > Identity Protection > Risk detections, you can trigger a sample sign-in risk or user-risk event for a test account to see it flow through the risk engine and hit your CA policy.

Review sign-in logs & policy impact • Sign-in logs – go to Monitoring & health > Sign-in logs, filter by Conditional Access and your policy names to see successes/failures. • Policy impact tab – if you’re using Microsoft-managed policies you’ll see a “Policy impact” blade showing who’s been prompted or blocked. • Drill into a specific sign-in, open the Conditional Access tab, and click the policy name to verify exactly which grant controls ran.

Common gotchas • MFA registration – if users aren’t registered for MFA yet, a sign-in risk policy can end up blocking them instead of prompting. Deploy your MFA registration policy first. • Break-glass exclusions – always exclude safe accounts so you can recover if something mis-fires. • Named Locations – verify any trusted IPs are in your Named Locations to avoid false positives from VPN or branch offices.

If you’ve walked through all of those steps and still aren’t seeing the expected behavior, we may need a bit more detail:

References

– Configure risk-based policies (sign-in & user risk): https://learn.microsoft.com/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies

– Conditional Access What If tool: https://docs.microsoft.com/azure/active-directory/conditional-access/what-if-tool

– Sign-in logs & policy impact: https://learn.microsoft.com/entra/identity/conditional-access/managed-policies#monitor-and-review

– Microsoft-managed CA policies overview: https://supportabilityhub.microsoft.com/.../5f562df6-6955-0166-5637-6562bd9662c8

Hope this helps you confirm your policies are firing as intended! Let me know once you’ve run those tests or if you hit any roadblocks.

If the answer is helpful, kindly upvote it. If you have extra questions about this answer, please click "Comment".
Khalid Hakim 0 Reputation points

2026-05-11T19:53:24.79+00:00

can we arranage a call please this is serious matter. and can not be resolved over public fourm. also i would like to have this ticket to be private.
Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator

2026-05-13T08:52:56.36+00:00

Khalid Hakim

Could you provide the update in private message or let us know if the resolution provided was helpful.

1 answer

Your answer

Khalid Hakim 0 Reputation points

2026-05-11T19:53:24.79+00:00

can we arranage a call please this is serious matter. and can not be resolved over public fourm. also i would like to have this ticket to be private.
Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator

2026-05-13T08:52:56.36+00:00

Khalid Hakim

Could you provide the update in private message or let us know if the resolution provided was helpful.

Answer 1

Use the built-in monitoring and troubleshooting tools to validate that the Conditional Access policies are working as intended before engaging support.

Review policy impact and report-only results
- In the Microsoft Entra admin center, open each Conditional Access policy and review the Policy impact tab to see how it affects interactive sign-ins over the last 24 hours, 7 days, or 1 month.
- If any policies are in Report-only mode, use the Policy impact view and the Conditional Access Insights and Reporting workbook to understand both individual and combined effects before switching them to On.
Validate behavior with sign-in logs
- Go to Entra ID → Monitoring & health → Sign-in logs.
- Filter by Username, Date, Conditional Access, and Resource to find test sign-ins for users covered by the policies.
- Open a sign-in event and select the Conditional Access tab to see which policies were applied, not applied, or in report-only mode, and why.
- Use Troubleshooting and support in the event to see specific failure reasons (for example, device not compliant, MFA required, etc.).
Test risk-based policies (risky sign-ins / risky users)
- Ensure risk-based conditions such as Sign-in risk and User risk are configured in the relevant policies.
- For risk-based access policies, confirm that:
  - The correct risk levels (for example, medium or high) are selected.
  - The access controls (for example, require multifactor authentication or require password change) match the intended behavior.
- Use the User sign-ins (non-interactive) and regular sign-in logs to confirm that risk-based policies are evaluated and that users can self-remediate where configured.
Use the “What If” tool for pre-checks
- In Protection → Conditional Access → Policies → What if, simulate sign-ins for representative users.
- Select the user, target apps/resources, and run What If to see which policies would apply and what controls would be enforced, without impacting production sign-ins.
Iterate and then enable
- After confirming expected results via Policy impact, Sign-in logs, and What If, move policies from Report-only to On.
- Continue to monitor sign-in logs and policy impact for a period after enabling to ensure there are no unintended blocks.

If a specific sign-in is failing or behaving unexpectedly, capture the Correlation ID and timestamp from the error page, then use that in the sign-in logs to pinpoint exactly which Conditional Access policy caused the behavior and adjust the policy configuration accordingly.

References: