Prepare a dedicated test tenant
Use a tenant with appropriate Conditional Access licensing, an account permitted to configure policies, and a small test group. Record a recovery path and review emergency-access exclusions. Do not experiment against your only administrative account.
Write the access expectation
Choose one test application and a simple control such as requiring MFA for the test group. Document which users and flows are in scope, plus the outcome you expect for each.
Set the policy to report-only
Create the policy with the intended assignments and controls, then select Report-only. Report-only evaluates the policy without enforcing its access decision; inspect current platform guidance before choosing settings.
Generate representative sign-ins
Sign in as the test users using the devices and authentication methods in your test plan. Include a case expected to meet the control and a case expected to need an additional step. Note the account, application, and UTC time.
Read the sign-in evidence
Open the matching sign-in events and inspect the report-only policy results. Separate policy evaluation from the result of the overall sign-in. Record unexpected scope, exclusions, authentication context, and any user prompts you observe.
Decide the next change
Adjust a mismatched assignment or condition and repeat the test. Keep this guide’s policy in report-only. Any later enforcement should follow a documented pilot, recovery plan, and the organization’s change process.
THE TAKEAWAY
Make the result reproducible.
Keep a short record of scope, expected behavior, observed behavior, evidence, and next steps. That record is the useful output of this lab.