Conditional Access Impact Matrix
By Jasper Baes
Installation
·
Report Bug
·
Conditional Access Blueprint
The Conditional Access Impact Matrix is tool #3 in the Conditional Access Blueprint.
This script solves 2 problems:
- what CA policies are applied to who?
- what is the user impact of my recent CA policy changes?
Output 1: excel matrix:
Output 2: impact changes:
Features:
- extract an Excel visualizing which CA policies are applied on each user
- filter in this table
- identify gaps and misconfigurations
- Predict user impact before enabling CA policies
- for documentation and compliance purposes
- easily and quickly answer questions like:
- what accounts have MFA enabled/disabled?
- what accounts are excluded form having a compliant device?
- what accounts are allowed to use legacy auth?
- ...
- visualize how recent CA changes impacted your users
Usage
Examples:
node index.js
node index.js --include-report-only
node index.js --compare 2024-09-01-CA-Impact-Matrix.json
node index.js --compare 2024-09-01-CA-Impact-Matrix.json --include-report-only
node index.js --limit 100
node index.js --group <groupID>
node index.js --type member
node index.js --limit 10 --type guest| Parameter | Description |
|---|---|
--include-report-only |
Includes Conditional Access policies that are in the ‘report-only’ state |
--compare <file.json> |
Compares the current output to a previously generated output specified by |
-t or --type |
Specifies the type of accounts to include (options: member or guest) |
-l or --limit |
Limits the number of users to the specified count |
-g or --group |
Restricts the scope to members of the specified group |
What running the script looks like:
Installation
Limitations
- Subgroups might not be fully evaluated
- Conditional Access policies scoped on users with Entra roles might not be evaluated
Contact
Jasper Baes (https://www.linkedin.com/in/jasper-baes)
Release history
Release version numbers: YEAR-WEEK
- 2024.41
- add 3 new parameters: limit, group and type
- 2024.40
- updated installation guide
- added .env template file
- 2024.39
- added parameter for 'report-only' CA policies
- bugfix (#1)
- 2024.38
- initial release (open-source)
License
Please be aware that the Conditional Access Impact Matrix code is intended solely for individual administrators' personal use. It is not licensed for use by organizations seeking financial gain. This restriction is in place to ensure the responsible and fair use of the tool. Admins are encouraged to leverage this code to enhance their own understanding and management within their respective environments, but any commercial or organizational profit-driven usage is strictly prohibited.
Thank you for respecting these usage terms and contributing to a fair and ethical software community.
Jasper Baes (https://www.linkedin.com/in/jasper-baes)
Buy Me a Coffee (https://buymeacoffee.com/jasperbaes)