Skip to content

Conditional Access policy builder

Pick a population, an app scope, and the controls you want, and get a report-only rollout order, an exclusions checklist, and an illustrative Microsoft Graph JSON export. Client-side, no sign-up.

This builds a rollout plan and a starting-point JSON shape — it does not connect to your tenant. Read how Conditional Access is evaluated before deploying anything it produces, and always start in report-only mode.

Policy name
Population
App scope
Conditions and grant
Safety

Rollout order

  1. Create the policy with every assignment and condition set exactly as intended, but leave it in report-only mode.
  2. Review the sign-in log's Report-only tab for at least one full business cycle (a week minimum, longer if any population signs in on a weekly-or-less cadence — a monthly batch job, a quarterly reviewer account) to see what the policy would have blocked or challenged.
  3. Confirm the break-glass emergency-access accounts are explicitly excluded from this policy's assignment before it ever goes live — not just from MFA, from the policy entirely.
  4. Switch the policy from report-only to On, ideally starting with a pilot group before the full intended population if the assignment isn't already narrow.
  5. Re-check the sign-in log after enforcement for unexpected blocks in the first 24-48 hours, then again after a week.

Exclusions checklist

  • Break-glass emergency-access accounts
  • Any service principal or workload identity that authenticates through this same condition set non-interactively

JSON (illustrative — verify against Graph API docs)

{
  "//": "Illustrative approximation of the Graph conditionalAccessPolicy shape — verify field names and casing against the current Microsoft Graph API reference before calling the API with this.",
  "displayName": "CA-001-AllUsers-AllApps-MFA",
  "state": "enabledForReportingButNotEnforced",
  "conditions": {
    "applications": {
      "includeApplications": [
        "All"
      ]
    },
    "users": {
      "includeUsers": [
        "All"
      ],
      "includeGroups": [],
      "excludeUsers": [
        "<break-glass-account-object-id>"
      ]
    }
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": [
      "mfa"
    ]
  }
}