Entra Conditional Access policy reviewer
Paste one Conditional Access policy or a whole export (Microsoft Graph identity/conditionalAccess/policies or the portal JSON view) to check it against common good practice, with a coverage summary across the set.
Checked locally in this browser; the JSON is not sent or saved. If you press the optional Explain with AI button below, only a summary of the findings and coverage is sent, with GUIDs and email addresses masked; the preview under "Exactly what will be sent" shows it.
Limits: the checks read only the pasted JSON, using the property names and values of the Microsoft Graph conditionalAccessPolicy resource. They do not see your tenant's sign-in data, the contents of named locations, group membership, licences or what is actually enforced, and good-practice checks are not a compliance verdict. Roll out every change in report-only mode first, keep at least one tested emergency-access account excluded, and confirm results in the Entra admin center.