Created conditional access policy to enable MFA for users. Need to verify whether it is configured correctly

Hi Shivakumar Totad,

The definitive way to verify your configuration immediately without disrupting users is to utilize the What If tool within the Microsoft Entra admin center. This diagnostic utility allows you to simulate a sign-in event based on the conditions you configured, such as user identity, IP location, or device state, to predict exactly which policies will trigger. You can access this by navigating to Protection > Conditional Access > Policies and selecting What If from the top command bar.

Inside the tool, select a test user included in your policy's scope and specify the cloud app you are targeting. Upon running the evaluation, the tool will generate a report separated into "Policies that will apply" and "Policies that will not apply." You need to confirm that your new policy appears in the "Policies that will apply" list and, crucially, that the Grant Controls details confirm "Require multi-factor authentication" is the enforced action. If the policy appears under "Policies that will not apply," the tool will provide the specific condition (e.g., location or device platform) that caused the mismatch, allowing you to troubleshoot the assignment logic.

For validation against live traffic without risking a lockout, you should initially set the policy state to Report-only. This mode evaluates the policy during actual sign-ins but does not enforce it. You can then audit the results by going to Identity > Monitoring & health > Sign-in logs. Select a specific sign-in event, click the Conditional Access tab, and review the "Report-only" section to verify that your policy result shows "Success" (meaning it would have required MFA). This confirms the policy scope is correct before you flip the toggle to On.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

VP

Hi Shivakumar Totad,

I wanted to follow up to see if you have had a chance to validate your MFA configuration. As mentioned, the What If tool located under Protection > Conditional Access > Policies in the Microsoft Entra admin center is the most immediate way to simulate whether your policy correctly targets specific users and conditions without impacting production. If you prefer validating against live traffic, switching the policy state to Report-only and reviewing the Conditional Access tab within specific Sign-in logs will confirm if the policy applies correctly before you enforce it. Please let me know if you need assistance interpreting the logs or simulation results.

If the issue has been successfully resolved, please consider accepting the answer as it helps other people sharing the same question benefit too. Thank you!

VP