Paste a Conditional Access policy JSON exported from Microsoft Entra ID and get a plain English explanation of exactly what it does — who it applies to, what it requires, and any exclusions.
... (top right) → View policy in JSON format (or use Graph Explorer / Export)Conditional Access is a feature within Microsoft Entra ID (formerly Azure Active Directory) that lets organisations control how and when users can access cloud applications and resources. Rather than a simple username-and-password check, Conditional Access policies evaluate signals such as who the user is, what application they're accessing, what device and location they're coming from, and the assessed risk level of the sign-in — then apply controls accordingly, such as requiring multi-factor authentication, blocking access entirely, or requiring a compliant device.
These policies are exported and stored as JSON, which is straightforward for automated systems but difficult for humans to read at a glance — especially when reviewing dozens of policies during a security audit or trying to understand why access was granted or denied in a particular scenario. Each policy can combine multiple conditions (users, groups, applications, locations, device platforms, risk levels) with multiple grant and session controls, and the JSON structure doesn't make these relationships obvious.
This tool takes that raw JSON and translates it into a plain English summary — explaining who the policy applies to, what exclusions exist, which applications are in scope, and exactly what's required for access to be granted. It's particularly useful for IT administrators documenting their tenant's security configuration, MSPs reviewing client environments, or anyone preparing for a Conditional Access audit or Microsoft Secure Score review.
Your policy JSON never leaves your browser. Nothing is uploaded, logged or stored anywhere.
Paste and click — get a plain English explanation in milliseconds. No waiting, no signup.
Great for documenting policies, security reviews, or explaining configurations to non-technical stakeholders.
Quickly spot if a policy has no exclusions, applies to all apps, or is set to report-only mode.
Yes, you'll need at least Security Reader or Conditional Access Administrator access in Microsoft Entra ID to view and export Conditional Access policies.
Yes — it handles all standard fields including users, groups, applications, platforms, locations, risk levels, grant controls and session controls. If a field isn't recognised, it's displayed as-is so you don't lose any information.
Absolutely. The plain English output is designed to be copied into security documentation, runbooks, or shared with stakeholders who aren't familiar with raw JSON.
If you're reviewing your own tenant, our M365 Security Scanner connects directly via Microsoft sign-in and shows all your Conditional Access policies with plain English explanations and best-practice findings automatically — no copy/paste needed.