Connecting your tenant

Prerequisites

• A Microsoft Entra ID tenant (any licence tier: Free, P1, or P2)
• A user account with Security Reader or Global Reader role
• Admin consent granted for AccessLens (one-time, by any Application Administrator)

Sign-in flow

1. 01

   Click “Sign in” on the AccessLens homepage

   You are redirected to Microsoft’s login page. This is the standard Microsoft identity flow. AccessLens never sees your password.

2. 02

   Authenticate with your organisational account

   Use your regular work account. Personal Microsoft accounts are not supported since they do not have Entra ID tenants.

3. 03

   Consent to permissions (first time only)

   You see a consent screen listing the read-only permissions AccessLens requests. If admin consent is required, an admin must approve first.

4. 04

   Policies load automatically

   Once authenticated, AccessLens fetches your Conditional Access policies via the Microsoft Graph API and renders them immediately.

Data we access

When connected, AccessLens reads the following from your tenant:

• Conditional Access policies: the full policy configuration including assignments, conditions, and controls
• Directory objects: names of users, groups, roles, and applications referenced in policies (for display purposes only)

Revoking access

You can revoke the AccessLens connection to your tenant at any time from the Entra admin center:

Entra admin center → Identity → Applications → Enterprise applications → AccessLens → Properties → Delete

Alternatively, individual users can revoke their own consent:

myaccount.microsoft.com → Permissions → AccessLens → Revoke consent

Connecting more than one tenant

MSPs and consultants can register additional client tenants against a single subscription and switch between them from the Tenants page. See Managing tenants for allowances, adding capacity, and volume pricing.