Product · What-If simulation
Test a sign-in before a user has to.
Describe a sign-in, run it against every Conditional Access policy in the tenant, and see the outcome, the controls it needs and the policy that decided it.
The AccessLens scenario builder, running three sign-ins in turn: a member opening Exchange from a compliant Windows device in an approved country, the same person on an old mail client, and a contractor on an unmanaged Mac. Each is evaluated against every Conditional Access policy in the tenant, and the builder names the policy that decided the outcome.
Every sign-in is checked against all 14 policies. Across the three on this page, 8 policies applied, 34 were skipped with a reason, and 1 sign-in was blocked outright.
Features
- Allowed, blocked or allowed with controls
- Applied and skipped, with reasons
- Twelve conditions per policy
- Saved test suites
- Compare and share
- Draft policies
Allowed after MFA and session limits
- CA001Require MFA for all usersApplies · MFA
- CA008Session limits for unmanaged devicesApplies · Session
- CA002Block legacy authenticationclient is browser
- CA003Require compliant device for ExchangeContractors — EMEA is excluded
- CA004Require MFA for privileged rolesout of user scope
- CA005Block access from unapproved countrieslocation is approved
- CA006Require MFA for guest userstargets guests only
- CA007Sign-in risk: require password changereport only
- CA009Require MFA for Azure managementout of app scope
- CA010Block downloads on unmanaged browsersreport only
- CA011Require phishing-resistant MFA for adminsreport only
- CA012Legacy: Intune enrolment exemptiondisabled
- CA013Block access for high user riskuser risk is not high
- CA014Require terms of use for gueststargets guests only
Every policy, applied or skipped, with the reason
Nothing is left out of the answer. Report-only policies are listed but never change the outcome, because they would not in Entra either.
The answer, and who gave it
The outcome, the controls the sign-in has to satisfy, and the policy that decided it.
- A normal working dayAllowed
Allowed after a compliant device, MFA and session limits · decided by CA003
- An old mail clientBlocked
Access blocked · decided by CA002
- A contractor on an unmanaged MacAllowed
Allowed after MFA and session limits · decided by CA001
Catch the change that moves a verdict
On Professional, save scenarios with the result you expect and re-run them after a change. Any that moved is flagged.
After the change: CA002 switched to report-only
- A normal working dayAllowed after a compliant device, MFA and session limitsHolds
- An old mail clientWas access blocked. Now allowed after a compliant device and session limits.Moved
- A contractor on an unmanaged MacAllowed after MFA and session limitsHolds
What it answers
Three questions, settled.
- 01
Will this person get in?
Allowed, blocked, or allowed with controls, with the MFA, device or session requirements spelled out and the blocking policy named when there is one.
- 02
Why did each policy apply or not?
Every policy lands in applied or skipped with the reason. Report-only policies are listed but never change the outcome, because they would not in Entra either.
- 03
Did my change break anything?
Save scenarios with the verdict you expect, then re-run the set after a change. Any scenario whose result moved is flagged, and you can accept the new baseline.
Plans
Everything here is on Starter.
Read from the same configuration the product uses to gate features.
- What-If SimulatorStarter and up
Starter
$240 billed yearly
For teams that need safer policy testing and clearer day-to-day analysis.
| Limit | Free | Starter | Professional | Enterprise |
|---|---|---|---|---|
| What-If simulator | Decision + first 2 applied policies | Full breakdown + compare/share | Full + saved test suite | Full + saved test suite |
Scenarios are evaluated in your browser against your policies and named locations. Nothing is written to Entra and no sign-in is attempted.
The rest of the product
More views of the same tenant.
Ask the question before your users do.
Read-only · no credit card · start with ten policies