Entra Policy Suite documentation · Verified against Entra Policy Suite 2.1.4 on Nov 11, 2026
Frequently asked questions
Does Entra Policy Suite change my Conditional Access policies?
Only when you ask. It reads them and compares them with the template library. Only a SuperAdmin changes a policy, and only after seeing what changes, with a reason: deploy a template as a new policy, edit or copy a policy, move an adopted policy to another stage (for example Pilot2 to Prod), promote or roll back a new version, put a policy back from a backup, or delete policies that are off. Nothing changes a policy on a schedule. Your policies follow the tags through the dynamic groups they target.
What happens the first time I switch user tagging on?
Nothing is written while the mode is Preview (the default): the run plans every change and lists it on the Tag changes page. Check the plan, run an Apply on a test scope from the Jobs page, and switch the mode to Apply when the result is right.
A user got the wrong tag. Why?
Start a Test run on that user from the Tagging Rules page and open the user in its result: it shows every rule that was evaluated for that user, each condition’s real value against the target, and which rule won. Usually an earlier rule for the same tag type matched first (a First tag type takes the first match), or a condition’s data was unavailable (for example AD group membership without a hybrid worker).
A new user was created. When is it tagged?
At the next scheduled run of user tagging: every run reads everyone. If that is too late, switch on Also tag a user at once when it changes (Settings > User tagging).
Can I keep a user out of tagging?
Yes: Never tag these users (Settings > User tagging), for example the directory synchronization account. Such a user keeps whatever tags it has. Keep the list short.
Someone changed a tag in the Entra admin center. What happens?
The tamper monitor reports it, with who made the change when the audit log says so, and an alert mail goes to the alert recipients. The change stays until an admin accepts or restores it on the Tamper page. The next tagging run does not silently overwrite it.
Do I need a hybrid worker?
Only for users synced from Active Directory. For them the tag must be written in AD, or directory sync overwrites it. Cloud-only users and devices are written through Microsoft Graph.
Can v1 and v2 run at the same time?
Yes, while you compare them. Both write the same attributes from the same rules, so switch v1’s scheduled tasks off before you set v2’s mode to Apply. See Move from v1.
Is there an Excel version of the identity report?
Every view exports to Excel or CSV, and the workbook can be mailed after each run (off by default). The web app is the report; the workbook is an export.
Which licenses does it need?
Entra ID P1 for the sign-in activity and the audit log. Intune for the device views of the identity report. Exchange Online for the mailbox-type conditions.
Verified against Entra Policy Suite 2.1.4 on 2026-11-11
Verified against Entra Policy Suite 2.1.4 on Nov 11, 2026