Graph pass-through
Sign-in triage
Investigate Conditional Access blocks without exporting CSVs from Entra. Sign-ins are fetched on demand from Graph - not stored long-term in Policytab.
Create your account, set up a workspace, and get 14 days of Pro - connect tenants, detect drift, and run impact analysis. No credit card required.
Triage workflow
Filter sign-ins by user, application, status, and day. Per-user pages rank CA policies that blocked, by failure count. Expandable event detail for deep debugging.
When a block warrants a temporary exception, request exclusion prefills the policy and user from the sign-in context.
- Cursor-paginated reads from Microsoft Graph
- Applied CA policies shown inline on each event
- Links to impact analysis and user what-if simulation
- Enterprise: extended analysis windows up to 90 days (Graph limit)
Which policy blocked, and what to do
The hard question after a lockout is not whether a block happened - it is which policy did it. The per-user view ranks the CA policies that blocked that user, ordered by failure count, so the policy responsible for the most pain is at the top.
Each event carries its Applied CA list - every policy Entra evaluated and the result for that sign-in. You read the actual enforcement outcome, not a guess, and decide whether the fix is a baseline change, an impact re-run, or a time-bound exclusion.
- Per-user policy ranking by blocked-sign-in count
- Applied CA shows each evaluated policy and its result
- Request exclusion prefills the policy and user
- Jumps straight into impact analysis or user what-if from the event
Pass-through, not a log store
Sign-ins are fetched on demand from Microsoft Graph and rendered for triage - Policytab does not warehouse them long-term. You are always looking at what Graph holds, not a stale copy that drifted from the source of truth.
Reads are chunked across 30-day Graph segments, with the analysis window reaching up to 90 days on higher tiers. That keeps requests inside Graph's limits while still letting you look back across a quarter when an investigation needs it.
Sign-in triage
Pass-through Microsoft Graph sign-in viewer. Filter by UPN, see blocking policies, and request time-bound exclusions from triage.