🚦 Conditional Access explainer

Paste your Conditional Access policies and read them as sentences, with the gaps highlighted.

🔒 Explained in your browser. Your policy JSON never leaves this page.

Paste Conditional Access policy JSON: one policy, an array, or the Graph response from GET /identity/conditionalAccess/policies

Export with PowerShell: Get-MgIdentityConditionalAccessPolicy -All | ConvertTo-Json -Depth 10 (scope Policy.Read.All). Group and user IDs are shown as counts; well-known role and app IDs are named.

Why this matters

Conditional Access is where zero trust actually gets enforced in Microsoft 365, and it is easy to get subtly wrong: a policy left in report-only, admins accepting phishable MFA, legacy protocols never blocked, or no break-glass exclusion on a block-everyone rule.

Reading JSON is how those mistakes survive review. Plain English, plus a coverage check across the whole set, makes them obvious.

🚦 Conditional Access explainer

Coverage

Each policy in plain English

Why this matters