Entra ID Conditional Access analyzer
Paste exported Conditional Access policies to check for missing admin MFA, unblocked legacy auth and overly broad scopes.
Runs in your browser · nothing is sentEntra IDNew
Everything runs in your browser. Nothing is sent anywhere, including group IDs, role IDs and policy names in your export.
How to use
- In Graph Explorer (or a script), run a GET request to "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies".
- Copy the JSON response.
- Paste it into the tool.
- Review the findings and the policy table, then export the report if needed.
Common scenarios
Export all policies and check that admin MFA and a legacy-authentication block are both actually in place and enforced, not just configured in report-only mode.
Paste a draft policy to confirm it excludes an emergency access account before switching it from report-only to enabled.
About this tool
Paste the JSON output of "GET /identity/conditionalAccess/policies" from the Microsoft Graph API (for example from Graph Explorer, or a script using Microsoft.Graph PowerShell), and the tool checks the whole set of policies for common gaps: no policy requiring multi-factor authentication for administrators, legacy authentication protocols left unblocked, policies with no grant or session controls at all, and a policy scoped to "All users" with no exclusions, which risks locking everyone out (including administrators) if something goes wrong. It also flags disabled and report-only policies and exact duplicates. Everything runs locally; group IDs, role IDs and policy names never leave your browser.
🔒 Your input stays in your browser and is never sent anywhere.
Frequently asked questions
Does this connect to my tenant?
No. There are no credentials and no API calls. You export the policies yourself, for example with Graph Explorer or the Microsoft.Graph PowerShell module, and paste the JSON here.
How does it decide whether a policy covers administrators?
It looks for a policy that includes a known privileged directory role (such as Global Administrator, by its role template ID, which is the same across all tenants) or the role value "All", targets all applications, is enabled, and requires MFA. A policy aimed only at specific apps or a group instead of a role will not satisfy this check, even if it effectively covers the same admins.
Why does an "all users, no exclusions" policy get flagged even if it looks fine?
It is a best-practice warning, not necessarily a misconfiguration. Microsoft recommends excluding at least one emergency access ("break-glass") account from broad policies, so that a mistake in the policy, an outage in a required control (like an MFA provider), or an unexpected condition match cannot lock out every account at once.
Does it simulate what would happen for a specific user or sign-in?
No, this version checks the policy set itself for structural gaps and risks. It does not evaluate a hypothetical sign-in against group memberships, device state or risk scores the way the real Conditional Access engine would.
What to do next
Found a problem or have a suggestion? Tell us