Report-only is not cost-free: How Conditional Access inflates your non-interactive sign-in logs
Every Conditional Access policy ends up in every sign-in record, even the ones that don’t apply. A KQL query to correlate CA policy changes with AADNonInteractiveUserSignInLogs ingestion, and why you shouldn’t just drop the column.