Managed service providers
Conditional Access across your customer fleet
One workspace for every customer Entra tenant - drift vs baseline, sign-in impact, MFA posture, time-bound exclusions, and change management that requires dry-run before apply.
Create your account, set up a workspace, and get 14 days of Pro - connect tenants, detect drift, and run impact analysis. No credit card required.
Fleet rollup
Connect customer Entra tenants once. Roll up drift, MFA posture, open alerts, and pending exclusions without switching portals per customer.
Safe CA changes at scale
Every policy write runs dry-run, optional second-admin approval, and snapshot rollback. Bulk change sets when the same fix applies everywhere.
Tenant isolation
Each customer tenant is isolated in Policytab. Your workspace only sees tenants you connected.
Roles your team already uses
Owner, admin, and read-only roles with audit on every mutation. Second-admin approval when your workspace requires it.
Onboarding that matches MSP delivery
Paste Graph app credentials or use automatic setup in the customer Entra tenant. Import policies into a snapshot, compare against the imported snapshot or a workspace baseline you assign, then remediate through the change workflow - not ad-hoc scripts. Internal IT teams use the same flow for a single production tenant.