Skip to content
AccessLens

Product · Gap analysis

Find what no policy is covering.

Gap analysis runs 75 checks against your policy set, mapped to five published frameworks, and conflict detection finds the policies that are working against each other.

The AccessLens conflicts and gaps console on the demo tenant, opening its worst findings in turn: two service accounts that authenticate with a password alone, an executive group exempt from high risk blocking, and a block policy that stops a report-only policy from ever reporting. Each is read from the Conditional Access policy definitions and ranked by how much of the tenant it changes.

75 checks in 11 categories, mapped to 5 published frameworks, run against every policy. On this demo tenant that leaves 10 findings open, 2 of which change who can sign in.

Features

  • Seventy-five gap checks
  • Five switchable frameworks
  • Report-only counts as partial
  • A severity-weighted score
  • Conflict detection
  • CSV export
  • Baseline Builder
5 critical23 high30 medium8 low
  • Configuration & Governance13
  • User & Identity Hygiene10
  • Known Exclusion Risks10
  • Administrator Protection8
  • Session Management7
  • Application Security7
  • Device Compliance6
  • Risk-Based Protection5
  • Location Intelligence5
  • Data Protection2
  • Agent Identity2

Seventy-five checks, in eleven categories

From administrator protection and legacy authentication to exclusion risks and agent identities. Each check passes, fails or partly passes.

Named against the standard

Every check maps to the published frameworks it answers to. Turn any of the five on or off and the analysis follows.

  • MS Baseline66 checks
  • CIS27 checks
  • CISA9 checks
  • NCSC3 checks
  • Maester4 checks

18 checks also carry their CIS v6.0 control ID.

Policies working against each other

Conflict detection compares every pair of policies, axis by axis, and names nine kinds of trouble, from shadowed to overly permissive.

  • CA007Sign-in risk: require password changeReport-only
  • CA013Block access for high user riskEnabled

Overlap6 of 6 axes

UsersAppsPlatformsLocationsClientsRisk

Block wins whenever both match, so CA007 has produced no report-only result for high user risk since it was created. The team is waiting on data that cannot arrive.

What it answers

Three questions, settled.

  1. 01

    What is not covered?

    Seventy-five checks across eleven categories, from administrator protection and legacy authentication to exclusion risks and agent identities. Each passes, fails or partly passes.

  2. 02

    Which standard says so?

    Checks map to Microsoft Entra recommendations, the CIS Microsoft 365 Benchmark, the CISA Zero Trust Maturity Model, the NCSC Cloud Security Principles and the Maester community standard.

  3. 03

    Are my policies working against each other?

    Conflict detection finds nine kinds of trouble, including blocking conflicts, redundant and shadowed policies, exclusion conflicts and overly permissive policies.

Plans

Start free. Professional unlocks all of it.

Read from the same configuration the product uses to gate features.

  • Conflict DetectionStarter and up
  • Gap AnalysisProfessional and up
  • Baseline BuilderEvery plan

Professional

$60/month

$720 billed yearly

For security teams who need full analysis and compliance.

MonthlyAnnualSAVE 20%

LimitFreeStarterProfessionalEnterprise
Gap analysis50+ checks50+ checks
Baseline Builder

The rest of the product

More views of the same tenant.

Find the gap before someone else does.

Read-only · no credit card · start with ten policies