Zero Trust · Free tool
Conditional Access Policy Builder
Design a persona-based Conditional Access policy set, adjust every policy visually, and download it as Microsoft Graph JSON with a script that creates it in your tenant, in report-only mode.
Step 1
Your organisation
Risk-based policies need P2 (included in E5 and E7).
Device compliance and app protection policies need Intune.
Start with MFA if passkeys aren't rolled out yet, then tighten.
How often TL1–TL3 identities sign in again.
Two-letter codes. Sign-ins from anywhere else are blocked. Leave empty to skip. Using: GB
Office egress IPs marked as trusted. Used to restrict service accounts.
Microsoft recommends blocking it wherever possible.
Policies are numbered in series: 0xx Global, 1xx Admins, 2xx Workforce, 3xx Guests, 4xx Service.
About this tool
How Conditional Access Policy Builder works
Start from your personas, such as admins, staff, guests and service accounts, and the builder suggests a Conditional Access policy set for them, based on the Trust Level Framework (TL1 Strategic Control to TL4 Workforce). Adjust any policy's users, apps, conditions and controls on screen.
Download a single policy or all of them as Microsoft Graph JSON, or a policy pack with a PowerShell script, Import-CaPolicies.ps1. Its dry run changes nothing; when you apply it, every policy is created in report-only mode, so you can check the sign-in logs before switching anything on.
Questions
Does it change my tenant?
No. The builder only produces files. Nothing changes until you run the import script yourself, and even then the policies start in report-only mode.
Do I need an account?
No account is needed to design. Downloading the files needs a free andykemp.com account, which takes a minute to create.
What are Trust Levels?
A way of grouping identities by the impact of their compromise: TL1 Strategic Control, TL2 Service Administration, TL3 Operational Administration and TL4 Workforce. The higher the impact, the stronger the authentication, device and session controls.
Related tools
Use it with
- Zero Trust ScorecardAssess your Microsoft 365 and Entra ID environment against core Zero Trust security principles.
- PIM Role DesignerDesign PIM around the Trust Level Framework (TL1–TL4). Analyse who holds each admin role in your tenant today, then deploy the design with a reviewed, reversible script.
- Break-glass Account BuilderDesign emergency access accounts properly: sign-in methods, custody, Conditional Access exclusions, alert queries, a test plan and a runbook, mapped to Microsoft, CIS, NCSC, NIST and ISM guidance.
- Phish-Resistant MFA Rollout PlannerPlan a phased MFA rollout with communication templates, success criteria, and risk mitigation for each wave.