2.2.4. Templates, Testing, and Troubleshooting
💡 First Principle: A policy engine that can lock out your whole company deserves a deployment pipeline: start from a known-good pattern, dry-run it against real traffic, pilot it, then enforce — and when things break, read the engine's own logs rather than guessing.
Templates seed the pipeline: Microsoft ships CA policy templates aligned to its recommendations (require MFA for admins, block legacy auth, require compliant device, and more) — created in report-only state by default, with break-glass exclusion prompts. Templates are the "minimal administrative effort to implement Microsoft-recommended policies" answer.
Report-only mode is the dry run: the policy evaluates on every matching sign-in and logs what it would have done — success, failure, user action required — without enforcing. Results accumulate in sign-in logs and the Conditional Access insights and reporting workbook (requires Log Analytics integration). Run new policies report-only for days, review impact, then flip on for a pilot group before broad enforcement.
What If answers hypotheticals without waiting for traffic: pick a user, app, IP, platform, risk level, and it lists which policies would apply/not apply and why. It's the pre-deployment sanity check and the first stop for "why is Maria being prompted?"
Troubleshooting live issues runs through the sign-in logs: each sign-in's Conditional Access tab lists every policy with its result (Success / Failure / Not applied / Report-only) and which assignment/condition matched or didn't. Classic diagnoses: policy not applied because the user was in an excluded group; "any block wins" surprises from a forgotten broad policy; legacy auth clients bypassing MFA (block them); device controls failing because the device isn't compliant/joined as the policy assumed.
⚠️ Exam Trap: Report-only ≠ partial enforcement. It never blocks or prompts anyone; enforcement for a subset is achieved by scoping an enabled policy to a pilot group. Also remember report-only can still cause one visible effect: device state collection prompts on some platforms.
Reflection Question: Why is "exclude break-glass accounts, deploy report-only, review the insights workbook, then enable for a pilot group" a better pipeline than enabling for everyone with a trusted-location exclusion?
