sysop@hub:~/tools/ca-analyzer$

ca-analyzer

Paste your Conditional Access policies and find out what they really enforce. Ten baseline protections are checked, the usual gaps are flagged (report-only, exclusions, trusted locations), and every policy is rewritten as one plain sentence. The JSON is parsed in your browser and never uploaded. Policies missing? The policy builder writes them for you.

Drop the policy export here, or click to choose a fileJSON from Microsoft Graph or Get-MgIdentityConditionalAccessPolicy

getting the export

Source	How
Graph PowerShell	`Get-MgIdentityConditionalAccessPolicy -All \| ConvertTo-Json -Depth 10 \| Out-File ca.json` (needs Policy.Read.All)
One script for both analyzers	Generate it in the script generator: a read-only export of Conditional Access policies and sign-ins.
Graph Explorer	`GET https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies`, then copy the response

The export contains object IDs of users and groups but no names, passwords or secrets. Groups and users therefore appear as counts ("3 groups"): this page cannot look up who is in them, which is exactly the part you should review by hand. The checks read the policy definitions only. They cannot see Security Defaults, per-user MFA, authentication method settings or whether your named locations are sensible, and they do not simulate a specific sign-in: for that, use the What If tool in the Entra admin center.