ConditionalAccess

Import, export, compare and bootstrap Conditional Access policies

← Toolkit

Connect to your tenant

This tool runs fully in your browser. It signs in with Microsoft (PKCE) and calls Microsoft Graph as you. Nothing is sent to a backend from this app.

Required delegated permissions:

  • Policy.Read.All - export and read existing Conditional Access policies
  • Policy.ReadWrite.ConditionalAccess - create/update Conditional Access policies
  • Directory.Read.All - resolve users/groups during import
  • User.Read - sign-in profile

Export Conditional Access policies

Export creates a JSON package with all policies and metadata, ready for backup, migration, or diffing later.

Import policies from JSON

Per policy you can choose the target state: disabled, report-only, or active.

Starter policy set

A small, very basic set for new tenants. Always review these before applying.

Diff two policy exports

Upload two export JSON files (old and new) and compare by policy name.

Debug log


      

    


    

      

        
About ConditionalAccess

        
ConditionalAccess is part of LCToolkit by Lieben Consultancy. It runs client-side and talks directly to Microsoft Graph from your browser.

        
What this tool can do

        
    
          
  • Export all Conditional Access policies as JSON
    • 
          
  • Import policies with optional name prefix/suffix
    • 
          
  • Overwrite existing policies when names match exactly (optional)
    • 
          
  • Set imported policy state per policy (disabled/report-only/enabled)
    • 
          
  • Resolve missing user/group IDs before writing policies
    • 
          
  • Compare two exports and show added/removed/changed policies
    • 
        

        
Important

        
    
          
  • Always test in a lab tenant first
    • 
          
  • Review each policy state before applying
    • 
          
  • The app does not auto-apply anything without your explicit click
    •