Direct answer
Start with a defined policy and pilot accounts, use report-only results to compare expected and evaluated outcomes, resolve gaps and confirm emergency access before an approved enforcement change.
Define the access matrix
List users, resources, client types and device states to test. Include intended allowed and denied cases, an unmanaged device where relevant and an authorized emergency account. Identify a safe test resource and the identity administrator responsible for rollback.
Evaluate the pilot
Microsoft recommends using report-only mode and reviewing policy impact before enabling its example compliant-device requirement. Generate representative sign-ins with test accounts and record the evaluated policy result, device status, time and application. Report-only predicts policy evaluation; it does not enforce the resulting decision.
Reference: Microsoft: Require compliant devices.
Approve and verify enforcement
Investigate unexpected results and compatibility issues before expanding scope. Ensure a tested emergency access method and an approved rollback plan. After enforcement, repeat allowed and denied cases and monitor users or clients that were absent from the pilot.
Include a client that may behave differently
Test a managed browser and a separately approved client application against the same pilot resource, because client capabilities and device signals can differ. Compare the report-only results with the access matrix and investigate unknown or unavailable device information. Do not enable enforcement until the policy owner understands the observed differences and the recovery route.
Assessment limits
Report-only results reflect the specific sign-ins observed and do not cover every client or future condition. Policy combinations and licensing can affect behavior.
Frequently asked questions
Does report-only block a noncompliant device?
No. It records evaluation without enforcing that policy's decision.
Why test emergency access?
A misconfigured access policy can lock administrators out; recovery must be prepared and monitored.
Does a single successful pilot sign-in cover every application?
No. Test the relevant applications, clients and user groups separately.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.