Once the restricting CA policy has been identified, inform the user about the requirements they must fulfill to successfully access Microsoft 365 applications.

Fortunately, the Conditional Access What If tool can help M365 admins validate CA policies before deploying them widely and minimize unexpected issues.

How to Run the What If Tool to Avoid Misconfigured Conditional Access Policies?

Check how the Conditional Access policy will apply to a user using the What If feature by following these steps:

• In the Microsoft Entra admin center, select Protection » Conditional Access » Policies » ‘What If’ in the top bar.

• 

• Then, select the user or service principal you want to evaluate.

  Note: You can check only one user or service principal at a time. You can also specify the cloud apps you want to test for that user.

• You can specify the cloud apps and other conditions, like client apps or device platforms, as needed.

• Once a user and conditions are selected, click the ‘What If’ button.

• 

The evaluation results will be displayed under two tabs: Policies that will apply and Policies that will not apply.

• Policies that will apply: Lists policy names, grant controls, session controls, and policy states affecting the user.

• Policies that will not apply: Lists policies that are irrelevant under the specified conditions.

• 

Additional Info: You can also check which Conditional Access policy blocks sign-ins using the methods below:

• Sign-in Diagnostics in Microsoft Entra

• Log Analytics in Microsoft Entra ID