Loading…
Snapshot Entra on resync, compare to your baseline, and sign-in impact modeling before enforcement.
Conditional Access policies are snapshotted on every resync and nightly backup. Drift is compared to the tenant's chosen comparison baseline (imported snapshot by default) with per-policy diffs.
Before enforcing a Conditional Access change, model who would likely have been blocked - confidence-rated, based on recent sign-in logs. Pro supports up to 30 days of sign-in history; Enterprise up to 90 days.
Pass-through sign-in log triage from Microsoft Graph. No long-term persistence in Policytab.
Import community CA baselines from GitHub into your workspace, tailor them, and assign a comparison baseline per customer tenant.
Time-bound exclusions, preview validation, optional approval gates, and snapshot-backed rollback.
Time-bound Conditional Access exclusions with reason, approver, and scheduled Entra group sync when they expire.
Preview, optional second-admin approval, apply, and rollback for Conditional Access policy writes. Five change kinds. Every write audit-logged.
Identity Protection risky users and recent detections, with dismiss and mark-compromised actions from the risk triage pages.
Roll up alerts, MFA posture, break-glass sign-ins, and Identity Protection across tenants.
Registration freshness and inferred staleness for every user, with explicit confidence labels.
In-app alert triage on Pro. Outbound Slack, Teams, email, and signed webhooks on Enterprise.
Emergency-access sign-ins and missing break-glass exclusions - monitored on schedule.
Dashboard rollup across every tenant in your workspace - one row per connected Entra tenant.
Multi-tenant isolation, audit logging, and workspace baselines imported from GitHub.
Multi-tenant isolation, encrypted credential storage, and append-only audit logging.
Connect an Entra tenant with admin consent - a guided, one-time setup of roughly 15 minutes per tenant. Then your first snapshot and drift report can land the same day.
