Tools · Identity defense · 12 / 25
Entra: each Conditional Access policy has its own result
The sign-in has an overall Conditional Access status, and each applied policy has its own result. Write the policy name and that result. Overall success does not mean every policy passed.
One sign-in, many policy lines
A sign-in record has an overall conditionalAccessStatus and a list of applied policies. Each entry has a display name and a result such as success, failure, notApplied, or a report-only result. The overall status is a summary. The list is where a single policy’s outcome lives.
A report-only result means that policy would have blocked or allowed had it been enforcing. It is not the same word as a failure on an enforced policy. Write the result string that is on the entry.
Do not collapse the list into the summary
Overall success can sit beside a policy whose own result is notApplied or report-only. Saying “Conditional Access passed” from the summary drops those entries. If the question is about one policy, quote that policy’s name and its result, and mention the overall status only as the summary.
If the list is empty, write “no applied policies on this record.” Do not fill in the policies you believe exist in the tenant. The tenant’s policy list is a different screen.
What to file
File the sign-in id, the time, the overall status, and for each policy you rely on, the display name and the result. Label a report-only result as report-only. Do not write that multi-factor authentication succeeded unless the entry you cite is the policy that required it and the result says so.
Worked case: success next to a report-only block
A lab sign-in shows overall conditionalAccessStatus success. The applied list has two entries. “Require MFA for lab users” has result success. “Block legacy clients” has result reportOnlyFailure. A draft says every policy passed because the sign-in succeeded.
The note quotes the overall status as success and then the two entries by name. The legacy-client policy would have blocked and is not enforcing. The MFA policy’s own result is success. “Every policy passed” is removed.
sign-in id: <id> time: 2026-11-03T16:40:22Z overall conditionalAccessStatus: success Require MFA for lab users: success Block legacy clients: reportOnlyFailure write: MFA entry succeeded; legacy policy would have blocked and is report-only not: every policy passed
Diagram
Read the policy list, not only the summary
Each entry has its own result string.
- Overall status
A summary on the sign-in. Not a substitute for the list.
- Policy name
The display name on that entry. Quote it.
- Result
success, failure, notApplied, or a report-only value, as printed.
- Empty list
No applied policies on this record. Do not invent them.
Check yourself
1. Where is one policy’s outcome on a sign-in record?
2. Overall status is success and one policy shows reportOnlyFailure. What is fair?
3. The applied list is empty. What do you write?