Built for CA operators
Policytab is built for teams who operate Entra Conditional Access in production - drift, sign-in impact, and changes that stay auditable.
Early access
Conditional Access operations at scale
Policytab helps MSPs and internal IT see what changed in Conditional Access, model who a policy would block, and keep every CA write auditable - across one tenant or a hundred.
What Policytab does
Conditional Access is where identity strategy meets daily firefighting. Policytab gives operators one workspace: resync-backed drift against a known baseline, sign-in impact before enforcement, and a change workflow with preview and audit logging on every write.
Policytab is in early access. Documentation is published at /docs so you can evaluate security before connecting production tenants.
Governed by default
Every CA policy write runs preview, optional second-admin approval, pre/post snapshots, and rollback when supported. Drift stays read-only until you open a change request.
Workspace baselines
Import community Conditional Access baselines from GitHub into your workspace library. Each tenant's drift baseline is chosen at onboarding - imported snapshot by default, or a workspace baseline you assign.
Focused scope
One product for Conditional Access operations. Architecture docs are public so security reviewers do not have to guess how tenancy works.