Conditional Access Policy Explainer

Paste a Conditional Access policy exported from Microsoft Graph. You get a one-sentence summary of what it does, directory roles and first-party apps resolved by name, and a list of the things worth a second look — starting with lockout risk.

Exporting a policy

From the portal

Entra admin center → Protection → Conditional Access → open a policy → Download policy (three dots at the top). You get the JSON this page expects.

From Graph PowerShell

Connect-MgGraph -Scopes "Policy.Read.All"
Get-MgIdentityConditionalAccessPolicy | ConvertTo-Json -Depth 10 | Set-Clipboard

Paste the whole array and every policy is explained in turn — useful for a tenant handover, or for working out why a sign-in was blocked when four policies overlap.

What it flags

The obvious one first: a policy that targets All users with no exclusions and requires a control your emergency-access accounts cannot satisfy. Microsoft's own guidance is to exclude at least two break-glass accounts from every Conditional Access policy, and the day you need them is not the day to discover you didn't.

Then the quieter ones — grant controls joined with OR when you meant AND, a generic MFA requirement where an authentication strength would let you insist on phishing-resistant methods, an exclude all trusted locations clause, and a sign-in frequency being undercut by a persistent browser session.