Conditional Access what-if

Sketch a sign-in against a starter policy pack, then export JSON or CSV. This is a worksheet, not the Entra what-if API.

UserAppDeviceLocationClientSign-in risk

Not blockedMFA required

Policy	State	Applies	Grant
Block legacy authentication Client app does not match.	on	No	—
Require MFA for all users All listed conditions match this sign-in.	on	Yes	Require MFA
Admins: MFA + compliant device User is out of scope.	on	No	—
Block guests from admin portals User is out of scope.	on	No	—
High sign-in risk requires MFA Sign-in risk is below the threshold.	report-only	No	—

Starter pack only. Map this to live policies in Entra, then run Microsoft's what-if before you flip report-only to on. Pair with the CA worksheet and the Conditional Access post.

JSON export

{
  "generatedAt": "2026-11-05T17:51:34.378Z",
  "disclaimer": "Heuristic worksheet. This is not the Entra what-if API and does not evaluate live policies.",
  "signIn": {
    "user": "member",
    "app": "Office 365",
    "device": "compliant",
    "location": "untrusted",
    "client": "browser",
    "risk": "none"
  },
  "results": [
    {
      "id": "block-legacy",
      "name": "Block legacy authentication",
      "state": "on",
      "applies": false,
      "grant": "—",
      "reason": "Client app does not match."
    },
    {
      "id": "mfa-all",
      "name": "Require MFA for all users",
      "state": "on",
      "applies": true,
      "grant": "Require MFA",
      "reason": "All listed conditions match this sign-in."
    },
    {
      "id": "admins-compliant",
      "name": "Admins: MFA + compliant device",
      "state": "on",
      "applies": false,
      "grant": "—",
      "reason": "User is out of scope."
    },
    {
      "id": "guests-restricted",
      "name": "Block guests from admin portals",
      "state": "on",
      "applies": false,
      "grant": "—",
      "reason": "User is out of scope."
    },
    {
      "id": "risky-signin",
      "name": "High sign-in risk requires MFA",
      "state": "report-only",
      "applies": false,
      "grant": "—",
      "reason": "Sign-in risk is below the threshold."
    }
  ],
  "summary": {
    "blocked": false,
    "mfa": true,
    "compliant": false,
    "reportOnly": 0
  }
}

CSV export

Policy,State,Applies,Grant,Reason
Block legacy authentication,on,no,—,Client app does not match.
Require MFA for all users,on,yes,Require MFA,All listed conditions match this sign-in.
Admins: MFA + compliant device,on,no,—,User is out of scope.
Block guests from admin portals,on,no,—,User is out of scope.
High sign-in risk requires MFA,report-only,no,—,Sign-in risk is below the threshold.

Sign-in user,member
App,Office 365

← All tools