CA Architect V2

Start here

What do you need to do?

Built with reference to j0eyv/ConditionalAccessBaseline.

Design Build from requirements

Create a broad Conditional Access strategy from the protections your tenant needs.

Design Build from an access scenario

Create a focused policy pack for one group, resource, partner, or exception.

Audit Audit an existing tenant

Paste or drop an export to compare current Conditional Access policies with the rebuild set.

Analyse Analyse sign-in logs

Upload an Entra ID sign-in log export to quantify Conditional Access gaps and build a matching strategy.

Step 1 of 4

What needs protecting?

Choose only the areas that apply to your environment. CA Architect will consolidate compatible controls into the fewest safe policies.

Strictness for selected requirements Strictness only tunes requirements you tick below. Unticked requirements generate no policies. Authentication posture Controls how selected human-user policies enforce authentication. It never creates a policy by itself. Retire non-phishing-resistant methods Creates a separate Authentication methods migration plan. This does not add unsupported settings to Conditional Access JSON. Rollout tolerance

Privileged admin hardeningPhishing-resistant MFA, admin sessions, and admin portals. Internal workforceBroad MFA, risk controls, devices, and sessions. Managed device postureUse compliant devices, app protection, and platform controls. Guests and partnersProtect external collaboration without hiding guest-specific tradeoffs. Service accountsSeparate non-human account controls and trusted-location decisions. Copilot and agent identitiesPreview/beta agent identity, agent user, and agent resource controls. Trusted network locationsUse named locations where the organization can maintain them safely. Legacy-auth exceptions requiredHighlight exception risk before blocking old protocols.

Step 2 of 4

Your consolidated architecture

Threat coverage

MITRE techniques addressed and remaining gaps

View coverage

Why some controls stay separate Guardrails for policies that should not be merged.

Baseline traceability Shows which original baseline policies are represented by each consolidated policy.

MITRE detail and residual gaps Extra ATT&CK mapping and items Conditional Access cannot solve alone.

Advanced threat model Optional scope, suggested threats, and control mapping for engineers who want to tune the strategy manually.

1 Choose scope 2 Confirm threats 3 Review controls

Choose an identity and target to see suggested threats and matching controls.

Scope

Identity and target

Identity profile

Target resources

Threat model

Threats to defend against

Step 1 of 4

Choose the closest access pattern

Start with the situation that best matches the access need. You can tune the important details in the next step.

Step 2 of 4

Describe the access requirements

These answers shape the policy. Tenant object IDs are requested only when you prepare the final export.

Target group display name Create one security group per scenario so membership, expiry, and review are obvious.

Account type Target app/resource Device trust Allowed platforms Location/network Risk tolerance Authentication requirement Uses Entra authentication strengths where stronger method quality is required. Session strictness

Access duration

Data sensitivity

Policy detail

Select a policy

Select a policy to review controls, structured edits, and Graph JSON.

Rollout decision

Recommended states start higher-risk controls in report-only where supported.

Prerequisites

Required objects

Sanitized Graph JSON

v1.0 policy shape

What do you need to do?

What needs protecting?

Your consolidated architecture

MITRE techniques addressed and remaining gaps

Identity and target

Identity profile

Target resources

Threats to defend against

Choose the closest access pattern

Describe the access requirements

Build the access decision from left to right

Minimum safe policy set

Secure access plan

MITRE coverage and remaining gaps

Build these scenario policies

Before Conditional Access

What to configure

Add the tenant objects required for export

Select a policy

Prerequisites

Required objects

Interactive Entra build path

Export overrides

Sanitized Graph JSON

Your current tenant export

Entra sign-in log gap analysis