Product · Flow visualisation
Read a policy the way a sign-in does.
The Flow view draws a Conditional Access policy as the path a sign-in takes through it: who is in scope, which conditions apply, and the grant or block it ends on.
The AccessLens Policy Flow, playing itself: CA001 — Require MFA for all users shown as the numbered steps Entra evaluates, from the sign-in arriving, through the users and applications in scope and the conditions checked, to the multifactor grant control and its two outcomes. A branch leaves the story at the excluded accounts, which the policy never applies to.
This policy is 7 steps from sign-in to decision, with 2 ways out drawn where they happen. Its 2 exclusions leave at the first of them, before any control is asked for.
Features
- Graph or cards
- Automatic layout
- Step details
- Summary and risk alongside
- Fullscreen and minimap
- Image export
- 01Sign-in attemptEntry
User, app, location and device are known
- 02Policy enabled?Policy
- 03UsersScope
All users
Excluded: access granted
- 04Applications
All cloud apps
- 05Client apps
Browser · Mobile apps and desktop clients
- 06Grant controlsEnforce
Require multifactor authentication
Not met: access blocked
- 07Access grantedOutcome
The same policy, read as cards
Switch the graph for a card list and read the policy top to bottom, one step at a time, with every way out named where it happens.
Every step opens
Select any step to see exactly what sits behind it: the users, apps, locations or controls, and who is excluded.
The policy applies to all users. Break-glass accounts and svc-backup-sync are excluded, so their sign-ins leave the policy here and are not affected by it.
ExcludedBreak-glass accountssvc-backup-sync
The whole set, against one sign-in
What-If draws every policy as a funnel. Each drops out at the first condition it fails, and the ones left decide.
- Policies14
- Enabled10
- Users in scope7
- App in scope6
- Conditions met3
r.nakamura@contoso.com · Office 365 Exchange Online · Windows 11 · compliant · London, United Kingdom
What it answers
Three questions, settled.
- 01
Who does this policy really apply to?
Users, groups, roles and their exclusions are drawn as the first gate, so an exclusion that lets someone straight through is on the page, not buried in a list.
- 02
What does it take to get through?
Applications, platforms, locations, client apps, device state and risk come next, then the control it ends on: MFA, an authentication strength, a compliant device or a block.
- 03
How does my whole set treat one sign-in?
The What-If simulator draws a funnel of every enabled policy: each drops out at the first condition it fails, and the survivors decide the outcome.
Plans
Start free. Starter unlocks all of it.
Read from the same configuration the product uses to gate features.
- Flow ViewEvery plan
- What-If SimulatorStarter and up
Starter
$240 billed yearly
For teams that need safer policy testing and clearer day-to-day analysis.
| Limit | Free | Starter | Professional | Enterprise |
|---|---|---|---|---|
| Flow visualizations | Basic | |||
| What-If simulator | Decision + first 2 applied policies | Full breakdown + compare/share | Full + saved test suite | Full + saved test suite |
The rest of the product
More views of the same tenant.
See the path a sign-in takes.
Read-only · no credit card · start with ten policies