tools/ca-policy-visualizer

Conditional Access review — no sign-in required

Paste a Conditional Access policy export (Graph, PowerShell, or portal JSON) and get the same 12 health checks as our live checker plus a policy coverage matrix — without signing anything in. No consent screen, no roles, no Graph call. The JSON is parsed by your browser and goes nowhere.

ca-policy-visualizer --paste

No sign-in, no consent, no Microsoft Graph call Parsed locally — the page makes zero network requests with your data Accepts Graph JSON, Graph PowerShell output, or a single policy export

▸How do I export my policies? (three ways, ~1 minute)

Graph Explorer (easiest, read-only): sign in at aka.ms/ge, run GET https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies, copy the response.

PowerShell: Connect-MgGraph -Scopes Policy.Read.All then Get-MgIdentityConditionalAccessPolicy -All | ConvertTo-Json -Depth 10.

Entra portal: Conditional Access → open a policy → the JSON view / export gives one policy at a time — paste one or several (this tool accepts a single object too, though checks work best with the full set).

▸Is pasting my policies safe?

The export contains configuration, not credentials — but it's still sensitive. That's why this page has no backend and makes no network requests with your paste: open DevTools → Network and analyse — nothing fires. User and group references appear as GUIDs in exports; this tool never resolves them (that would need a Graph call), so nothing identifying leaves the JSON you can already see. Prefer live data with names resolved? Use ./ca-policy-check instead.

policy matrix

policy	state	scope	mfa	block	device	risk	legacy	excl

This is the paste-in version — ./ca-policy-check reads your tenant live with names resolved. And when the findings need fixing, the assessment is fixed-price, one week → ./view pricing

Checks are heuristics for a directional read — they can't see Security Defaults, per-user MFA, or the intent behind an exclusion, and a pasted export reflects a point in time. GUID-scoped policies are analysed structurally without resolving identities. Nothing you paste is transmitted or stored.