Product · Policy analysis
Every policy, read the way you would explain it.
AccessLens rewrites each Conditional Access policy as one plain sentence, scores the set as a whole and lays every condition side by side, so a review no longer means opening policies one at a time.
Every one of the 14 policies in this demo tenant is written out as a sentence and rated. 4 score as high risk, and 8 leave a named person or group out.
Features
- Plain-English summaries
- Risk rating per policy
- Search and state filters
- Security score
- Policy matrix
- Report-only readiness
- CA001Require MFA for all usersMedium
When all users access any cloud app using browser or mobile apps and desktop clients, multifactor authentication is required. Break-glass accounts and svc-backup-sync are excluded.
- CA003Require compliant device for ExchangeMedium
When all users access Office 365 Exchange Online on Windows, macOS, iOS, or Android, device to be marked as compliant is required. Contractors — EMEA is excluded.
- CA005Block access from unapproved countriesHigh
When all users access any cloud app from all locations or excluded: Approved countries, access is blocked. Travel exemption — temporary is excluded.
- CA009Require MFA for Azure managementMedium
When all users access Microsoft Azure Management, multifactor authentication is required. Break-glass accounts and svc-terraform-deploy are excluded.
- CA013Block access for high user riskHigh
When all users access any cloud app at high user risk, access is blocked. Break-glass accounts and Executive team are excluded.
- CA006Require MFA for guest usersMedium
When guest and external users access any cloud app, multifactor authentication is required. Microsoft Teams is excluded.
Every policy, as the sentence it means
Users, apps, conditions and the control each policy ends on, resolved into a sentence you can read aloud, with every exclusion named.
A rating, and the reasons for it
Each policy is scored from 0 to 100 and rated high, medium or low, with the factors behind the score listed beside it.
- lowersMultifactor authentication is required
- raisesNo device compliance requirement
- raisesVery broad scope: all users and all cloud apps
- raisesNo location conditions, so the policy behaves the same from anywhere
Every condition, side by side
The policy matrix sets each policy against eleven condition dimensions, so shared scope and missing coverage show at a glance.
| UserUsers | AppApps | PlatPlatforms | LocLocations | CliClients | RiskRisk | |
|---|---|---|---|---|---|---|
| CA001 | ||||||
| CA003 | ||||||
| CA005 | ||||||
| CA006 | ||||||
| CA008 | ||||||
| CA013 |
Condition setHas exclusionsNot used
What it answers
Three questions, settled.
- 01
What does each policy actually do?
Each one is summarised as who it applies to, which apps, from where and what happens, with a high, medium or low risk badge beside it.
- 02
Where do my policies overlap?
The policy matrix sets every policy against eleven condition dimensions in one grid, so shared scope and missing coverage show up without cross-referencing.
- 03
Is this report-only policy safe to switch on?
Report-only insights read your sign-in logs and give a verdict: safe to enable below 2% of sign-ins affected, needs review above that, high risk above 10%.
Plans
Start free. Professional unlocks all of it.
Read from the same configuration the product uses to gate features.
- Policy VisualizationEvery plan
- Matrix ViewStarter and up
- Report-Only InsightsProfessional and up
Professional
$720 billed yearly
For security teams who need full analysis and compliance.
| Limit | Free | Starter | Professional | Enterprise |
|---|---|---|---|---|
| Policies | 10 | 25 | Unlimited | Unlimited |
| Policy matrix | Read-only | |||
| Report-Only Insights |
Report-only insights read sign-in logs, which needs AuditLog.Read.All consent and a Microsoft Entra ID P1 or P2 licence.
The rest of the product
More views of the same tenant.
Read your policies in plain English.
Read-only · no credit card · start with ten policies