Skip to content
AccessLens

Quick scan · no sign-in

Read your policy export before you connect anything.

Drop in a Conditional Access JSON export and AccessLens parses it in this browser: posture score, risk breakdown, policy browser and flow diagrams. No OAuth consent, no account, no upload.

  • Nothing is transmittedThe file is read by JavaScript on this page and never sent to a server.
  • Stored in this browser onlyResults live in local storage until you clear this site’s data.
  • GUIDs stay unresolvedWithout a tenant connection there is no directory to resolve names against.

Analyse a policy export

A JSON export from PowerShell, Graph Explorer or the Entra portal.

Drop your policies JSON here

or browse files

Parsed in your browser and kept in this browser’s local storage. Nothing is uploaded.

01The export

Getting the export.

Either method returns the same policy objects the Graph API serves. Reading policies needs Policy.Read.All; nothing here writes to the tenant.

PowerShell
# Install the module (once)
Install-Module Microsoft.Graph -Scope CurrentUser

# Connect and export
Connect-MgGraph -Scopes "Policy.Read.All"
Get-MgIdentityConditionalAccessPolicy | ConvertTo-Json -Depth 10 > policies.json
Graph Explorer
GET https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies

# Save the JSON response as policies.json

Scope

What a file can answer, and what needs the tenant.

The split is not a paywall drawn through the middle of a feature list. It is the line between what a policy export contains and what only a live directory can resolve.

From the exportFree, no sign-in

  • Security posture score

    A single 0–100 score with sub-scores for MFA enforcement, device compliance, location filtering and risk-based access.

  • Risk distribution

    How many policies fall into high, medium and low risk, so the order of work is decided before you start.

  • Policy state breakdown

    Enabled, disabled and report-only counts: the fastest way to find the policy somebody switched off in 2023.

  • Searchable policy browser

    The full set with state, conditions, assignments and grant controls, filterable across every policy.

  • Plain-English summaries

    Each policy rewritten as one line, so a stakeholder who has never opened Entra can read the rule.

  • Interactive flow diagrams

    Conditions feeding into controls as a graph, where bypass paths and thin coverage become visible.

Needs a connected tenantRead-only consent

  • Conflict detection

    Overlapping and contradictory rules across the policy set.

  • What-If simulation

    Test a user, app and device scenario before you deploy a change.

  • Gap and compliance analysis

    Policies scored against Microsoft, CIS, CISA, NCSC and Maester checks.

  • Matrix and export

    Cross-reference matrix view and exportable audit reports.

  • Baseline builder

    Compare your policies against recommended security baselines.

  • Change tracker

    Policy modifications over time, as diff-style change history.

Start with the file you already have.

Analyse a policy export

Connecting a tenant later resolves user, group and application names ·