Question

A financial services company plans to introduce a new Conditional Access policy that will require multifactor authentication for all users accessing Microsoft 365 apps. The security team is concerned that a misconfigured policy could lock out thousands of users or block legitimate service accounts. They want to measure the real-world impact of the policy against actual sign-ins before it starts enforcing controls. Which approach should you recommend?

Accepted Answer

Deploy the policy in report-only mode and review the sign-in logs to evaluate its impact before enabling enforcement.

Answer

Enable the policy for a pilot group of five users, then expand it gradually to the full organization.

Answer

Create the policy in the disabled state and use the Conditional Access What If tool to simulate every user account.

Answer

Enable the policy during a maintenance window and monitor Azure Monitor alerts for authentication failures.