Skip to content
AccessLens

Conditional Access, without the guesswork

Turn Microsoft Entra Conditional Access into a clear, interactive map you can explore, test and understand.

The problem

Each policy makes sense on its own. The trouble is what they do together.

At sign-in, every policy that applies is evaluated at once, and no screen in the Entra portal shows you the combined result.

Turn policy sprawl into decisions

Find the policies that matter, see how they overlap, and close the gaps before anyone signs in through them.

The AccessLens conflicts and gaps console on the demo tenant, opening its worst findings in turn: two service accounts that authenticate with a password alone, an executive group exempt from high risk blocking, and a block policy that stops a report-only policy from ever reporting. Each is read from the Conditional Access policy definitions and ranked by how much of the tenant it changes.

Every policy is read, and every pair of them compared. On this demo tenant that is 91 comparisons behind 10 findings, 2 of which change who can sign in.

Features

  • Policy Flow
  • What-If simulation
  • Conflicts and gaps
  • Framework evidence
  • OAuth governance
  • Change tracking

The AccessLens Policy Flow, playing itself: CA001 — Require MFA for all users shown as the numbered steps Entra evaluates, from the sign-in arriving, through the users and applications in scope and the conditions checked, to the multifactor grant control and its two outcomes. A branch leaves the story at the excluded accounts, which the policy never applies to.

Every policy, drawn as the decision it makes

Assignments, conditions and controls as a graph you can follow, one step at a time.

Evidence your auditor will accept

Every finding names the controls it answers to. The report is tenant state, not a questionnaire.

  • MS Baseline
  • CIS
  • CISA
  • NCSC
  • Maester

Know what changed, and when

State flips, exclusion edits and new policies, attributed and on a timeline.

2026-08-25Added “Executive team” to excluded users
2026-08-21Sign-in frequency tightened from 12 hours to 4 hours
2026-08-12Added “svc-backup-sync” to excluded users
2026-07-30Added “Contractors — EMEA” to excluded users
2026-06-11Included applications widened from Exchange Online to Office 365

The platform

Why this is one product and not six tools.

GRAPH

One read of your tenant

Policies, groups, applications, roles and sign-in data are read once through Microsoft Graph and normalised into a single model.

MODEL

A shared policy model

Every view, from the flow graph to What-If to gap analysis, runs on that same model, so two screens can never disagree about your tenant.

ANALYSIS

Findings, not dashboards

Conflicts, gaps, permission risk and drift are computed from the model and ranked into one queue of things worth your attention.

Also included

The rest of the toolkit.

  • Policy matrix

    Every policy and condition in one grid for side-by-side comparison.

  • Baseline builder

    Compose a target policy baseline and measure your tenant against it.

  • Report-only insights

    Find policies that have been parked in report-only and forgotten.

  • Multi-tenant

    Switch between the tenants you manage without re-authenticating each time.

  • Team access

    Invite colleagues so analysis is shared rather than trapped on one laptop.

  • Free JSON scan

    Analyse an exported policy file locally before connecting anything.

Put your tenant on the record.

Read-only access · policy contents stay in your browser