Conditional Access policies stuck in Report-only

A Report-only Conditional Access policy is evaluated on every sign-in and then ignored — it writes a verdict to the log and lets the sign-in through regardless. Report-only is the correct place to START a policy, but a policy left there for months is protection the tenant believes it has and does not.

A scan reports where your tenant stands on this check — pass, fail with a step-by-step fix, or not applicable if your licensing doesn’t include the feature. When Tenant Strike can’t read a setting with read-only access, it says unverified and gives you a one-command way to confirm it yourself — it never guesses.