Microsoft Entra · Windows app · Version 1 (beta)
Your acceptable use policy, accepted and proved
Most organisations have an AUP. Few can show that every user and guest has read it. AKC AUP uploads yours as Microsoft Entra Terms of Use and creates the Conditional Access policies that require it, report-only first, with your break-glass group always left out, and keeps a record for your audit file.
Version 1, still in beta: tenant checks, deploy, change and roll back all work. Updates install themselves when you next open the app. Talk to Andy about having your AUP written and rolled out.
How it works
From a PDF to a policy people accept
Terms of Use and Conditional Access, set up in one pass. Nothing changes in your tenant until you deploy.
- 1
Check the tenant
Entra ID P1, your role, Terms of Use and policies already there, and your break-glass group found for you. Read only.
- 2
Choose the model
A member AUP and separate guest terms, members only with guests later, or one AUP for everyone.
- 3
Documents
Your PDF for each, checked before upload, with its name in Entra and the title people see.
- 4
Acceptance
Open the document before accepting, per-device acceptance, and how often people accept again.
- 5
Who it applies to
All members or chosen groups, every guest type, exclusions, and your own policy numbering.
- 6
Review and deploy
Every value on one screen. Each policy report-only unless you switch it on.
What you get
Acceptance you can show an auditor
For Cyber Essentials, ISO 27001 (A.5.10) and the NHS DSPT: the policy, the enforcement and the evidence, in one tool.
Least privilege
Built for the Conditional Access Administrator role, and Security Reader to look. It checks your role and licence and says what's missing, rather than asking for Global Administrator.
Break-glass always left out
It finds your emergency access group from your existing policies, leaves it out of every policy it creates, and won't deploy without one.
Report-only first
Every policy starts report-only. Switch each one on when you're ready: guests On and members report-only while you check the sign-in logs, or the other way round.
Members and guests apart
Employees get the full AUP; guests get shorter terms about confidentiality and access. The member policy leaves guests out, so nobody is asked twice.
Nothing hidden
Every value sent to Entra is on a review screen first. Names already in the tenant are refused, not duplicated.
Change it later
Open a deployment, see it as it is in Entra now, and change the policies or terms in place, with the changes listed before they're applied.
Evidence for the audit
A deployment record, in HTML and JSON, of what was created, when and by whom, with Entra's IDs. Roll back from it at any time.
Nothing leaves your tenant
It runs on your PC with its own app registration in your tenant. Nothing is sent to Andy Kemp Consulting, and logs never hold tokens or your PDF.
Get started
Download and run
Download AKC-AUP.exe from downloads.andykemp.com and run it. There is nothing to install, and it doesn't need administrator rights. Keep it somewhere you can write to, such as a tools folder, and it updates itself.
- Windows 10 or 11 (x64)
- Microsoft Entra ID P1, or a plan that includes it
- The Conditional Access Administrator role to deploy
- A Cloud Application Administrator, once per tenant, to set it up from the Tools menu
- Your AUP as a PDF, one for each audience
Questions
Frequently asked
What does version 1 do, and why is it still beta?
The whole set-up: tenant checks, Terms of Use for members, guests or everyone, the Conditional Access policies that require them, a review screen, deploy, change a deployment in place, roll back, and a deployment record. It stays labelled beta while it's proven on more tenants and the EXE gets code signing. Still to come: an acceptance report, and extra terms for specific apps or partner organisations. Each update installs itself when you next open the app.
Which licence and roles does it need?
Microsoft Entra ID P1, or a plan that includes it, such as Microsoft 365 Business Premium, E3 or E5. Deploying needs the Conditional Access Administrator role; Security Reader can check the tenant. A Cloud Application Administrator sets it up once per tenant from the Tools menu: AKC AUP creates its own app registration in your tenant, with delegated permissions only. Global Administrator isn't needed.
Can I do members now and guests later?
Yes. Choose Members only, guests later: one Terms of Use and one policy for your own people, with every guest and external user type left out. Add guest terms later by deploying again with the separate model.
What can I change after deploying?
Everything about the policies: On or report-only, name, who they apply to and who's left out. For the Terms of Use, Entra only allows the name and "must open before accepting" to change: the PDF, title, per-device and re-acceptance are fixed once the terms exist, so changing those means new terms.
Where do my sign-in tokens and documents go?
Nowhere but your PC and your own tenant. Sign-in uses Microsoft's own sign-in library and its token cache. Your PDF goes only to Entra, and neither it nor any token is written to AKC AUP's logs. Nothing is sent to Andy Kemp Consulting.
Is it free?
Yes. Download the single EXE and run it: there's nothing to install and no sign-up. If you'd like the AUP written and the rollout done for you, that's a service Andy offers.
Related tools
Use it with
- Conditional Access Policy BuilderBuild a persona-based Conditional Access policy set around the Trust Levels, edit each policy visually, and export Graph JSON with a script that deploys it in report-only.
- Break-glass Account BuilderDesign emergency access accounts properly: sign-in methods, custody, Conditional Access exclusions, alert queries, a test plan and a runbook, mapped to Microsoft, CIS, NCSC, NIST and ISM guidance.
- AKC AppDeployA Windows app that packages a Win32 app and publishes it for Intune in one flow: the .intunewin built for you, silent switches worked out, a local test run for the uninstall and detection, the Company Portal listing and logo filled in, upload and assign, then supersede it with the next version, with a least-privilege sign-in. Version 1 (beta). Try the live demo.