# Conditional Access rollout worksheet
Sentinel Identity · Version 1 · 2026-10-01
Free to copy and adapt. Planning aid; no tenant changes are performed.

## Define the control
- Policy name / owner:
- Risk or requirement addressed:
- Included users / groups / workload identities:
- Included resources / user actions:
- Conditions:
- Grant controls (including AND / OR choices):
- Session controls:
- Exclusions and their documented justification:
- Licensing and product support checked against current Microsoft documentation:

## Prepare the pilot
- Pilot membership and why it is representative:
- Device, browser, client, location, and authentication method combinations:
- App owner and help-desk contacts:
- Emergency access handling reviewed by:
- Existing policies that also apply:
- Report-only observation window:

## Record observations
| Scenario | Expected result | Enforced policy result | Report-only result | Evidence | Owner |
| --- | --- | --- | --- | --- | --- |
| | | | | | |

Keep report-only findings separate from actual enforcement. Investigate unexpected results before expanding scope.

## Decision to enforce
- Unexplained failures resolved:
- Positive and negative tests completed:
- User communications ready:
- Approval:
- Exact pilot scope at enforcement:
- Rollback trigger / original configuration / operator:
- Observation period and monitoring owner:

## Expansion decision
- Actual pilot outcome:
- Support incidents and unresolved exceptions:
- Next population and rationale:
- Approval / date:

Reference: https://learn.microsoft.com/en-us/entra/identity/conditional-access/plan-conditional-access