Writing
What we learn reading other people’s Conditional Access.
Policy design notes, Entra changes worth reacting to, and product updates, written for the person who actually has to maintain the rules.
More posts
- 29 Jul 2026Industry News
One Click From Compromise: How Microsoft Is Quietly Locking Down OAuth App Consent
Microsoft has spent twelve months moving OAuth app consent from users to admins, and the latest wave just landed. Here is what changed, why, and the existing app grants the new defaults do not touch.
Stephen Devlin · 10 min read
- 27 Jul 2026Security Tips
Adversary-in-the-Middle: When the Stolen Token Is the Whole Attack
Adversary-in-the-middle lets the user sign in to the real service, then steals the session token it hands back. MFA and device compliance already passed, so replay walks straight through. Here are the Conditional Access controls that make a stolen token useless, and how AccessLens checks you actually have them.
Stephen Devlin · 9 min read
- 20 Jul 2026Security Tips
Device Code Phishing: The MFA-Protected Sign-In That Still Hands Attackers a Session
Device code phishing sends users through Microsoft's real login page, so MFA and passkeys can still authenticate an attacker's waiting session. Here is the Conditional Access control that stops it and how AccessLens helps you deploy it safely.
Stephen Devlin · 8 min read
- 21 May 2026Tutorials
Getting the Most Out of the AccessLens Free Tier
The Free tier is a working analyzer, not a trial. A walkthrough of every Free feature in the order you should use them, with annotated screenshots from the Demo tenant and a 30-minute first session you can run today.
Stephen Devlin · 8 min read
- 13 May 2026Tutorials
Travel Exemptions in Conditional Access Without the Stale Policy Pile-Up
How to handle international travel tickets without editing CAPs every week or leaving a trail of stale named locations. A time-bound exemption group with PIM or access packages does the work for you.
Stephen Devlin · 6 min read
- 2 Mar 2026Dev Log
Dev Log: Week of February 24
Homepage redesign, a Change Tracker and Enforcement Simulator for the March 27 OIDC enforcement, PostHog analytics, and a new Report-Only Insights page in beta.
Stephen Devlin · 6 min read
- 24 Feb 2026Security Tips
Conditional Access for AI Agents: Securing the Next Identity Surface
Microsoft has extended Conditional Access to AI agent identities in Entra ID. Here's what it actually controls, how to set up a block-by-default posture, and how to monitor agent activity without additional tools.
Stephen Devlin · 7 min read
- 20 Feb 2026Dev Log
Dev Log: Week of February 13
Multi-tenant support, a policy scoring system, a What-If simulator bug that was silently giving wrong results, gap analysis upgrades, and a conflict detection overhaul.
Stephen Devlin · 5 min read
- 20 Feb 2026Security Tips
Entra's New "Require Risk Remediation" Grant Control. A Smarter Approach to User Risk
Microsoft has added a new grant control to Conditional Access that changes how organisations respond when Entra ID Protection flags a user as risky. Here's what it does and how to set it up.
Stephen Devlin · 5 min read