CA Architect V2 - Consolidated Conditional Access Strategy Builder

Consolidated Conditional Access strategy builder

Design stronger environments with fewer, clearer policies.

CA Architect V2 simplifies Conditional Access by compressing best-practice controls into the fewest safe policies, explaining each build step, and mapping the design to MITRE ATT&CK so teams can see which identity threats they are mitigating.

Threats0

Selected Policies0

Monitor0

Preview/Beta0

Warnings0

Import Match0%

Attack vectors addressed

MITRE coverage for selected requirements

Best-practice strategy

Requirements

Strictness for selected requirements Strictness only tunes requirements you tick below. Unticked requirements generate no policies. Rollout tolerance Privileged admin hardeningPhishing-resistant MFA, admin sessions, and admin portals. Internal workforceBroad MFA, risk controls, devices, and sessions. Managed device postureUse compliant devices, app protection, and platform controls. Guests and partnersProtect external collaboration without hiding guest-specific tradeoffs. Service accountsSeparate non-human account controls and trusted-location decisions. Copilot and agent identitiesPreview/beta agent identity, agent user, and agent resource controls. Trusted network locationsUse named locations where the organization can maintain them safely. Legacy-auth exceptions requiredHighlight exception risk before blocking old protocols.

Recommended strategy

Strongest safe design

Why some controls stay separate Guardrails for policies that should not be merged.

Baseline traceability Shows which original baseline policies are represented by each consolidated policy.

MITRE detail and residual gaps Extra ATT&CK mapping and items Conditional Access cannot solve alone.

Advanced threat model Optional scope, suggested threats, and control mapping for engineers who want to tune the strategy manually.

1 Choose scope 2 Confirm threats 3 Review controls

Choose an identity and target to see suggested threats and matching controls.

Scope

Identity and target

Identity profile

Target resources

Threat model

Threats to defend against

Scenario planner

Real access situation

Start with a template

Target group display name Create one security group per scenario so membership, expiry, and review are obvious. Target group object ID Guidance renders without this, but Graph export needs the real group object ID. Trusted named location object ID Needed when the scenario limits access to, or excludes, a trusted network location.

Account type Target app/resource Device trust Allowed platforms Location/network Risk tolerance Authentication requirement Uses Entra authentication strengths where stronger method quality is required. Session strictness

Access duration

Data sensitivity

Scenario outcome

Secure access plan

Threats mitigated

MITRE and safety view

Recommended policy pack

Build these scenario policies

Prerequisites

Before Conditional Access

Manual build notes

What to configure

Policy detail

Select a policy

Select a policy to review controls, structured edits, and Graph JSON.

Rollout decision

Recommended states start higher-risk controls in report-only where supported.

Prerequisites

Required objects

Manual build guide

Entra portal checklist

Generated from the configured export shape

Structured edits

Export overrides

Sanitized Graph JSON

v1.0 policy shape

Design stronger environments with fewer, clearer policies.

MITRE coverage for selected requirements

Strongest safe design

Identity and target

Identity profile

Target resources

Threats to defend against

Secure access plan

MITRE and safety view

Build these scenario policies

Before Conditional Access

What to configure

Select a policy

Prerequisites

Required objects

Entra portal checklist

Export overrides

Sanitized Graph JSON

Your current tenant export