Merge pull request #192488 from MicrosoftGuyJFlo/WorkloadIdentityReportOn

[Azure AD] Conditional Access - Workload Identity update from PG

Author: jborsecnik

articles/active-directory/conditional-access/media/workload-identity/conditional-access-workload-identity-risk-policy.png

@@ -6,7 +6,7 @@ services: active-directory
 ms.service: active-directory
 ms.subservice: conditional-access
 ms.topic: how-to
-ms.date: 03/04/2022
+ms.date: 03/22/2022
 
 ms.author: joflore
 author: MicrosoftGuyJFlo
@@ -51,7 +51,7 @@ Create a location based Conditional Access policy that applies to service princi
 1. Under **Cloud apps or actions**, select **All cloud apps**. The policy will apply only when a service principal requests a token.
 1. Under **Conditions** > **Locations**, include **Any location** and exclude **Selected locations** where you want to allow access.
 1. Under **Grant**, **Block access** is the only available option. Access is blocked when a token request is made from outside the allowed range.
-1. Your policy can be saved in **Report-only** mode, allowing administrators to estimate the effects, or policy is enforced by turning policy **On**.
+1. Set **Enable policy** to **On**.
 1. Select **Create** to complete your policy.
 
 ### Create a risk-based Conditional Access policy
@@ -73,9 +73,13 @@ Create a location based Conditional Access policy that applies to service princi
    1. Select the levels of risk where you want this policy to trigger.
    1. Select **Done**.
 1. Under **Grant**, **Block access** is the only available option. Access is blocked when a token request is made from outside the allowed range.
-1. Your policy can be saved in **Report-only** mode, allowing administrators to estimate the effects, or policy is enforced by turning policy **On**.
+1. Set **Enable policy** to **On**.
 1. Select **Create** to complete your policy.
 
+#### Report-only mode
+
+Saving your policy in Report-only mode won't allow administrators to estimate the effects because we don't currently log this risk information in sign-in logs.
+
 ## Roll back
 
 If you wish to roll back this feature, you can delete or disable any created policies.