Governed CA writes
Conditional Access change management
Every CA policy write in Policytab runs preview, optional second-admin approval when required, then apply, with snapshot-backed rollback when supported.
Create your account, set up a workspace, and get 14 days of Pro - connect tenants, detect drift, and run impact analysis. No credit card required.
Change workflow operators can trust
Change requests move through draft, preview, optional approval, apply, and rollback states. Failed previews stay blocked until re-run. Stale previews cannot apply. Status locking prevents double-apply races.
- Five change kinds: state, assignment, condition, grant controls, application
- Per-kind warnings: critical disable, MFA removal, AND→OR loosening, admin portal bypass
- Pre and post snapshot on every successful apply
- Bulk change sets apply the same payload across selected tenants
Graph writes only through the workflow
Policytab invokes Microsoft Graph to patch policies only from the approved apply path. Operators see the preview diff in the console; security reviewers get append-only audit entries for every transition.
Conditional Access change management
Gate every Entra Conditional Access write behind preview, optional approval, pre/post snapshots, and rollback when supported. Five change kinds, append-only audit.