// tools/ca-builder

Conditional Access policy builder

Start from a template or build your own. You'll get the policy as JSON and the Graph PowerShell to create it in report-only mode, so you can measure the impact before switching it on.

Runs entirely in your browser. Nothing you paste is sent anywhere.

Start from a template

Policy name

Users

Include

Exclude group (break-glass accounts)

Target resources

Cloud apps

Conditions

Client apps

Device platforms

Sign-in risk (needs Entra ID P2)

User risk (needs Entra ID P2)

Locations

Grant

Access control

Session

Sign-in frequency

Persistent browser session

State

Graph PowerShell

Policy JSON

Check the result in the Conditional Access visualiser and read report-only and What If before switching anything on. Property names follow Microsoft Graph's conditionalAccessPolicy resource.