Skip to content
TheAdminStack Practical security engineering
Find a tool/ Get in touch
Identity · Entra Conditional Access

Conditional Access Analyzer & Designer

Drop in your Conditional Access policy export to see baseline coverage against Microsoft’s policy templates, lockout and break-glass risks, bypasses and retired controls — then design the missing policies and export Graph JSON or a PowerShell deployment script.

Paste or drop a conditionalAccessPolicy export to begin · Client-side only — nothing leaves the browser

100% in-browser
How to export your policies (read-only) 
# PowerShell — Microsoft Graph SDK (Policy.Read.All, read-only)
Connect-MgGraph -Scopes "Policy.Read.All"
Invoke-MgGraphRequest -Method GET `
  -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" `
  -OutputFilePath capolicies.json

# …or the SDK cmdlet (PascalCase output is fine too)
Get-MgIdentityConditionalAccessPolicy -All | ConvertTo-Json -Depth 10 | Out-File capolicies.json -Encoding utf8

# …or Entra admin center → Conditional Access → Policies → open a policy → Download JSON

Nothing analysed yet. Drop an export above, paste one, or hit Load sample to see the analyzer with a fictional tenant.

How it works

The analyzer normalises each conditionalAccessPolicy object (Graph v1.0 or beta, camelCase or PascalCase) and evaluates it in three passes. Baseline matches enabled and report-only policies against Microsoft’s Conditional Access templates — a control counts as met only when an enforced policy satisfies it, and policies that exclude trusted locations do not count as unconditional MFA. Findings lint each policy for lockout risk, missing or inconsistent emergency-access exclusions (inferred from objects excluded across most all-users policies), location and role bypasses, combined MFA/strength grants, the read-only Require approved client app grant, stale report-only policies and policies with no control. The Designer generates Graph-ready JSON for each template using your naming prefix and break-glass exclusions, defaulting to report-only.

Limits: object IDs are not resolved to names (the tool never calls Graph), named-location and authentication-strength definitions are not in the policy export, and results are a review aid — confirm with sign-in logs and the What If tool before changing production policy.

Frequently asked questions

What does the Conditional Access Analyzer do?

It reads an export of your Microsoft Entra Conditional Access policies and shows which of Microsoft's recommended baseline policies you have enforced, which are only in report-only mode and which are missing. It also lints each policy for lockout risk, inconsistent emergency-access exclusions, trusted-location bypasses, excluded admin roles, retired grant controls and policies that have no effect.

Is my policy export uploaded anywhere?

No. Parsing, analysis and policy generation run entirely in your browser. Nothing is sent to a server, and the tool never connects to your tenant or asks for consent. Policy exports contain object IDs rather than names, but treat them as sensitive and handle them under your normal data-handling rules.

How do I export my Conditional Access policies?

Run Connect-MgGraph -Scopes Policy.Read.All then Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" -OutputFilePath capolicies.json. Output from Get-MgIdentityConditionalAccessPolicy -All | ConvertTo-Json -Depth 10 and single-policy JSON downloaded from the Entra admin center also work — you can drop several files at once.

What baseline is the tenant scored against?

Microsoft's Conditional Access policy templates and guidance on Microsoft Learn: block legacy authentication, MFA (and phishing-resistant MFA) for the 14 recommended admin roles, securing security-info registration, MFA for all users, guests and Azure management, blocking device code flow, device-based access, unknown platforms, browser session controls, app protection on mobile and — with Entra ID P2 — sign-in and user risk policies. Each check links to the Microsoft Learn article it is based on.

How do I deploy policies from the Designer?

Download a single policy's JSON and use Upload policy file on the Conditional Access policies page in the Entra admin center, or download the generated PowerShell script, review it, and run it with the Microsoft Graph PowerShell SDK. Policies are created in report-only mode by default and existing policies with the same name are skipped.

Why does it warn about break-glass accounts?

Microsoft recommends excluding emergency-access accounts from Conditional Access policies so a misconfiguration or MFA outage cannot lock every administrator out. The analyzer infers your likely emergency-access exclusions from objects excluded across most all-users policies and flags policies that do not exclude them.

AuthMethods Analyzer → Entra MFA / passkey readiness from a registration export TokenDecoder → JWT / SAML / OIDC token inspector KQL Builder → Sentinel & Defender XDR query builder