Product · Change tracking
Know which Microsoft changes will hit your policies.
Microsoft keeps changing how Conditional Access behaves. AccessLens tracks the changes that matter, checks each one against your policies and shows what to fix before the date arrives.
- 15 Jun 2026Baseline Scopes EnforcementRolling out · in effect1 affected
- 6 Jul 2026Security Info Registration EnforcementEnforced · in effect1 affected
- 30 Sept 2026Custom Controls Edit-LockUpcoming · in effect1 affected
- 1 Oct 2026Legacy ID Protection Risk Policies RetireUpcoming · in effectnotice
- 1 Feb 2027SMS & Voice MFA RetirementUpcoming · in 97 daysnotice
Impact on this tenant
Approved Client App Retirement
4 of 18 policies affected
- Admin Zero Trust - Multi-Layer ProtectionNo fallback grant control. Policy is frozen: admins cannot adjust scope, exclusions, or grant controls. Eventually approved-app enforcement may stop entirely.
- Sensitive Apps - Layered Security ControlsNo fallback grant control. Policy is frozen: admins cannot adjust scope, exclusions, or grant controls. Eventually approved-app enforcement may stop entirely.
- B2B External Collaboration - Conditional AccessNo fallback grant control. Policy is frozen: admins cannot adjust scope, exclusions, or grant controls. Eventually approved-app enforcement may stop entirely.
- Mobile BYOD - Require App ProtectionNo fallback grant control. Policy is frozen: admins cannot adjust scope, exclusions, or grant controls. Eventually approved-app enforcement may stop entirely.
6 Microsoft Entra changes tracked, 4 with an impact analysis. Checked against the 18 policies in this demo tenant, 6 need attention before their dates arrive.
Features
- Tracked Microsoft changes
- Impact analysis per policy
- Affected or safe, rated by severity
- Before and after
- Remediation steps
- Timeline and countdown
- Microsoft documentation linked
- Before
- Currently enforces: Require MFA AND Require compliant device AND Require approved client app.
- After
- No fallback grant control. Policy is frozen: admins cannot adjust scope, exclusions, or grant controls. Eventually approved-app enforcement may stop entirely.
What to do
- 01Open "Admin Zero Trust - Multi-Layer Protection" in the Entra admin center → Conditional Access. The policy is read-only since June 30, 2026 and can only be disabled or deleted, not edited.
- 02Create a new policy with "Require app protection policy" covering the same users and apps. Editing the frozen policy to add the control is no longer possible.
- 03Ensure Intune app protection policies are configured for the apps users access (Outlook, Teams, OneDrive, etc.). See https://learn.microsoft.com/en-us/intune/intune-service/apps/app-protection-policy
- 04Run the replacement policy in Report-Only mode to confirm users on iOS/Android can still access apps via app protection policy.
What changes for each policy, and what to do
Every affected policy gets how it behaves today, how it will behave after the change, and the steps to fix it before the date.
On one timeline
Each change with its date, whether it is upcoming, rolling out or enforced, and how long is left.
- 15 Jun 2026Baseline Scopes EnforcementRolling out · in effect
- 30 Jun 2026Approved Client App RetirementEnforced · in effect
- 6 Jul 2026Security Info Registration EnforcementEnforced · in effect
- 30 Sept 2026Custom Controls Edit-LockUpcoming · in effect
- 1 Oct 2026Legacy ID Protection Risk Policies RetireUpcoming · in effect
- 1 Feb 2027SMS & Voice MFA RetirementUpcoming · in 97 days
Affected or safe
Where a change has an impact analysis, every policy is checked and sorted, so a clear change is known to be clear.
- Baseline Scopes Enforcement1 of 18
- Approved Client App Retirement4 of 18
- Security Info Registration Enforcement1 of 18
- Custom Controls Edit-Lock1 of 18
What it answers
Three questions, settled.
- 01
What is changing, and when?
6 Microsoft Entra changes tracked, each with its date, whether it is upcoming, rolling out or enforced, and a countdown.
- 02
Which of my policies are affected?
Where a change has an impact analysis, every policy is checked and sorted into affected or safe, and each affected policy is rated high, medium or low.
- 03
What do I do about it?
Each affected policy gets a description of how it behaves before and after the change and the steps to fix it, next to Microsoft’s timeline and documentation.
Plans
Free, on every plan.
Read from the same configuration the product uses to gate features.
- Change TrackerEvery plan
Free
For admins who want a clear first view of their Conditional Access posture.
Change tracking is in beta. Every change links to Microsoft’s own documentation for it.
The rest of the product
More views of the same tenant.
See what the next change breaks.
Read-only · no credit card · start with ten policies