sysop@hub:~/tools/ca-policy-builder$

ca-policy-builder

Pick the Conditional Access policies you want, tell the page which group holds your emergency accounts, and take away a script that creates them in report-only mode. Before you run anything, the page tells you who this set could lock out. Nothing you enter leaves your browser.

your tenant

Break-glass group, object IDExcluded from every policy. Two emergency accounts belong in it. Create the policies asReport-only logs what would happen and blocks nobody. Name prefixPolicies are named like CA001 - Block legacy authentication.

policies

start from

rolling it out

Break-glass first. Two cloud-only Global Administrator accounts with long random passwords, stored offline, in one security group. Set an alert on every sign-in of these accounts.
Create in report-only. Run the script. Nothing changes for users yet.
Read the logs for a week. Entra, Sign-in logs, open a sign-in, tab Report-only. Look for Failure: those are the people and devices the policy would have blocked.
Fix what you find. Register MFA methods, replace scripts that use a user password, enrol devices, add named exceptions.
Switch on one policy at a time. Start with the block on legacy authentication and MFA for admins. Leave a day between policies so you know which one caused a call.
Check the result. Export the policies and run them through the CA analyzer, and test single sign-ins in the simulator.

The policies follow the templates Microsoft publishes in the Entra admin center, with a break-glass exclusion added to each. Conditional Access needs Entra ID P1, the two risk policies need P2. This page cannot see your tenant: whether a policy fits depends on your users, devices and existing policies. Read more in Conditional Access explained and the Entra ID hardening checklist.