A company wants to test a new Conditional Access policy that would require access to a sensitive finance application only from compliant devices. The security team is concerned about accidentally locking users out before they can verify the policy behaves as expected. Which Conditional Access policy state should they use to evaluate the impact without enforcing the controls?