← cd ~/tools
// tools/ca-matrix
Conditional Access coverage matrix
Load your Conditional Access policies and see every combination of users and apps in one grid. Each cell shows what's enforced, from blocked to MFA to nothing at all, so gaps such as guests on a key app with no MFA stand out straight away.
Runs entirely in your browser. Nothing you paste is sent anywhere.
Get your policies
Connect-MgGraph -Scopes Policy.Read.All
Get-MgIdentityConditionalAccessPolicy -All | ConvertTo-Json -Depth 10 | Out-File ca-policies.jsonHow to read it
- Rows are the users the policies name: all users, guests, each directory role and each group. Columns are the apps they name: all cloud apps, Office 365, the Azure management API and each app ID.
- A cell is covered when an enabled policy applies to that user and app with no conditions. It's partly covered when the policy only applies under some conditions, such as certain locations, platforms or risk levels, or when it's report-only.
- Exclusions count. A group excluded from a policy shows the gap in its own row.
- Session controls on their own don't count as coverage, but they're listed in each cell's details.
This is a model of your policies, not a sign-in simulation. Use What If in the Entra admin centre to check a specific sign-in, and see the Conditional Access visualiser to read each policy in plain English.