Manual and Automatic Documentation of Conditional Access Policy Settings as PowerPoint Presentation
Windows has its Power Toys and now Microsoft’s identity management team is getting into the act with Identity Power Toys (idPowerToys), an app to help Azure Active Directory power users get work done. The initial release of the app is limited to a Conditional Access Documentator, a useful tool to read the configuration of conditional access policies from Azure AD and generate documentation in the form of a PowerPoint presentation (using components from Syncfusion). The IdPowerToys GitHub repository is available for all to browse and contribute to.
Conditional access policies set conditions and criteria for Azure AD to examine inbound connections to decide if a connection should be accepted or rejected. A typical conditional access policy is one that requires accounts to use multi-factor authentication (MFA). The policy could even define that the authentication method used for the MFA response should be a certain strength. For instance, an SMS response is unacceptable but a response from the Microsoft Authenticator app is OK.
Only its creators love the GUI used to manage conditional access policies in the Microsoft Entra (Azure AD) admin center. It’s easy to make mistakes and people have been known to lock themselves out by implementing conditions that they can’t meet. It’s also easy to create conditions that make the daily interaction between people and apps miserable, such as cranking up the sign-in frequency for connections. Many different policies might exist in large enterprise tenants, and it can be hard to understand the flow that a connection traverses as Azure AD applies conditions from the set of policies. Examination of records in the Azure AD sign-in log throws some light onto the situation but can be a drag.
The Conditional Access Documentator
Enter the Conditional Access Documentator, the first IdPowerToys app. The app is available online and supports two modes:
Automatic generation: IdPowerToys retrieves of conditional access policies using an enterprise app created in the tenant’s Azure AD and generates a PowerPoint presentation. You can opt to mask different elements of the output. For instance, if you choose to mask policy names, IdPowerToys generates its own version of the policy name based on what it does. If you choose to mask user names, IdPowerToys outputs their account identifier instead of their display name.
Manual generation: A tenant administrator runs a PowerShell command or uses the Graph Explorer to retrieve the JSON-formatted information about conditional access policies and pastes the results into a text box. IdPowerToys uses the information to create the PowerPoint file. Masking isn’t supported for manual generation.
An enterprise app is a registered Azure AD app owned by another tenant that creates an instance of the app in other tenants. Alongside the app instance, Azure AD creates a service principal to hold the permissions needed by the app. An administrator must grant consent before the app can use the permissions to access Azure AD to fetch the information about conditional access policies.
Some will be uneasy about granting an app permissions like Directory.Read.All (read information about accounts, groups, and other objects from Azure AD) and Policy.Read.All (read all policy information for the organization). However, as shown in Figure 1, the permissions are delegated, not application, which means that an account holding an administrator role must sign-into the app to use the permissions.
Figure 1: Permissions assigned to the IdPowerToys app
If you’re uneasy about creating an enterprise app with permissions in your Azure AD, use the manual generation method and run the Invoke-GraphRequest cmdlet to fetch the data and output it to the clipboard. This command only works when run by an administrator:
Figure 2 shows the results retrieved from the Graph pasted into the IdPowerToys app.
Figure 2: Pasting conditional access policy settings into IdPowerToys to generate documentation manually
In either case, the PowerPoint presentation generated to document conditional access policies is the same. For my tenant, which has 12 conditional access policies (not all in use), the app generated a 609 KB file with 13 slides (one title slide and one for each policy), divided into sets of enabled and disabled policies. Within a set, policies are sorted by last modified date, so the policy with the most recent modification appears first.
Figure 3 shows a presentation generated by IdPowerToys with details of a conditional access policy in the slide. This is a common policy to require MFA for guest access, with tweaks to require a certain authentication strength and to set the sign-in frequency to 90 days. You can see that the policy is enabled.
Figure 3: PowerPoint depiction of a conditional access policy
Visualize Conditional Access Policies Differently
Conceptually, generating documentation for conditional access policies isn’t difficult. Graph API requests exist to fetch the information and after that it’s a matter of parsing the conditions, actions, access controls, and session controls to output in your desired format. Some might prefer their documentation in Word. I think PowerPoint is just fine. IdPowerToys delivers documentation that just might help organizations visualize, clarify, and rationalize their conditional access policies, and that’s a good thing.
Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.
Trying to use this since it looked like an awesome tool but I have tried the automatic and manual methods without success. Both throw the following error : Sorry something went wrong. Please try again.
how can we be sure about security and privacy? and what about GPRD concept?
Are the data uploaded to the idpowertoys site?
how can we be sure that no data are uploaded outside the enterprise?
Loading...
The information is read from your Azure AD configuration to generate the report. There’s no data stored on the idPowerToys site.
Loading...
This is nothing even close to being worthy of the PowerToys name. Come on. How about, it’s time for Microsoft to completely finish a product or feature before moving onto the next shiny object? Don’t release unfinished shit Microsoft.
Hi Tony , i have tried with my test account (no azure subscription) with premium p1 license… i have few policies switched on and off…. when i tried Automatic the documents is downloading but with no policies in it
I’ve also tried both methods, both fail with “Something went wrong”. App has all of the necessary permissions granted.
The Manual method currently states “NOTE: THE MANUAL MODE IS TEMPORARILY NOT AVAILABLE WHILE A BUG IS BEING FIXED.”
My error, using Graph Explorer:-
“error”: {
“code”: “AccessDenied”,
“message”: “You cannot perform the requested operation, required scopes are missing in the token.”,
That error indicates that your Graph Explorer session doesn’t have the Policy.Read.All permission. Use the Modify Permissions tab to assign and grant consent to the permission and you should be able to retrieve the information.
I don’t know why the developers took the manual mode offline. I guess someone found a problem…
First, thank you Tony for this, it sounds very interesting and i want definitely to try it.
I just tried the both methods as well, for the manual mode i am getting the same error like others.
For the automatic mode the PowerPoint document gets created but only with one site where i can see the tenant ID, tenant name, generated by (my global admin account), generated on.
{"id":null,"mode":"button","open_style":"in_modal","currency_code":"EUR","currency_symbol":"\u20ac","currency_type":"decimal","blank_flag_url":"https:\/\/office365itpros.com\/wp-content\/plugins\/tip-jar-wp\/\/assets\/images\/flags\/blank.gif","flag_sprite_url":"https:\/\/office365itpros.com\/wp-content\/plugins\/tip-jar-wp\/\/assets\/images\/flags\/flags.png","default_amount":100,"top_media_type":"featured_image","featured_image_url":"https:\/\/office365itpros.com\/wp-content\/uploads\/2022\/11\/cover-141x200.jpg","featured_embed":"","header_media":null,"file_download_attachment_data":null,"recurring_options_enabled":true,"recurring_options":{"never":{"selected":true,"after_output":"One time only"},"weekly":{"selected":false,"after_output":"Every week"},"monthly":{"selected":false,"after_output":"Every month"},"yearly":{"selected":false,"after_output":"Every year"}},"strings":{"current_user_email":"","current_user_name":"","link_text":"Virtual Tip Jar","complete_payment_button_error_text":"Check info and try again","payment_verb":"Pay","payment_request_label":"Office 365 for IT Pros","form_has_an_error":"Please check and fix the errors above","general_server_error":"Something isn't working right at the moment. Please try again.","form_title":"Office 365 for IT Pros","form_subtitle":null,"currency_search_text":"Country or Currency here","other_payment_option":"Other payment option","manage_payments_button_text":"Manage your payments","thank_you_message":"Thank you for supporting the work of Office 365 for IT Pros!","payment_confirmation_title":"Office 365 for IT Pros","receipt_title":"Your Receipt","print_receipt":"Print Receipt","email_receipt":"Email Receipt","email_receipt_sending":"Sending receipt...","email_receipt_success":"Email receipt successfully sent","email_receipt_failed":"Email receipt failed to send. Please try again.","receipt_payee":"Paid to","receipt_statement_descriptor":"This will show up on your statement as","receipt_date":"Date","receipt_transaction_id":"Transaction ID","receipt_transaction_amount":"Amount","refund_payer":"Refund from","login":"Log in to manage your payments","manage_payments":"Manage Payments","transactions_title":"Your Transactions","transaction_title":"Transaction Receipt","transaction_period":"Plan Period","arrangements_title":"Your Plans","arrangement_title":"Manage Plan","arrangement_details":"Plan Details","arrangement_id_title":"Plan ID","arrangement_payment_method_title":"Payment Method","arrangement_amount_title":"Plan Amount","arrangement_renewal_title":"Next renewal date","arrangement_action_cancel":"Cancel Plan","arrangement_action_cant_cancel":"Cancelling is currently not available.","arrangement_action_cancel_double":"Are you sure you'd like to cancel?","arrangement_cancelling":"Cancelling Plan...","arrangement_cancelled":"Plan Cancelled","arrangement_failed_to_cancel":"Failed to cancel plan","back_to_plans":"\u2190 Back to Plans","update_payment_method_verb":"Update","sca_auth_description":"Your have a pending renewal payment which requires authorization.","sca_auth_verb":"Authorize renewal payment","sca_authing_verb":"Authorizing payment","sca_authed_verb":"Payment successfully authorized!","sca_auth_failed":"Unable to authorize! Please try again.","login_button_text":"Log in","login_form_has_an_error":"Please check and fix the errors above","uppercase_search":"Search","lowercase_search":"search","uppercase_page":"Page","lowercase_page":"page","uppercase_items":"Items","lowercase_items":"items","uppercase_per":"Per","lowercase_per":"per","uppercase_of":"Of","lowercase_of":"of","back":"Back to plans","zip_code_placeholder":"Zip\/Postal Code","download_file_button_text":"Download File","input_field_instructions":{"tip_amount":{"placeholder_text":"How much would you like to tip?","initial":{"instruction_type":"normal","instruction_message":"How much would you like to tip? Choose any currency."},"empty":{"instruction_type":"error","instruction_message":"How much would you like to tip? Choose any currency."},"invalid_curency":{"instruction_type":"error","instruction_message":"Please choose a valid currency."}},"recurring":{"placeholder_text":"Recurring","initial":{"instruction_type":"normal","instruction_message":"How often would you like to give this?"},"success":{"instruction_type":"success","instruction_message":"How often would you like to give this?"},"empty":{"instruction_type":"error","instruction_message":"How often would you like to give this?"}},"name":{"placeholder_text":"Name on Credit Card","initial":{"instruction_type":"normal","instruction_message":"Enter the name on your card."},"success":{"instruction_type":"success","instruction_message":"Enter the name on your card."},"empty":{"instruction_type":"error","instruction_message":"Please enter the name on your card."}},"privacy_policy":{"terms_title":"Terms and conditions","terms_body":null,"terms_show_text":"View Terms","terms_hide_text":"Hide Terms","initial":{"instruction_type":"normal","instruction_message":"I agree to the terms."},"unchecked":{"instruction_type":"error","instruction_message":"Please agree to the terms."},"checked":{"instruction_type":"success","instruction_message":"I agree to the terms."}},"email":{"placeholder_text":"Your email address","initial":{"instruction_type":"normal","instruction_message":"Enter your email address"},"success":{"instruction_type":"success","instruction_message":"Enter your email address"},"blank":{"instruction_type":"error","instruction_message":"Enter your email address"},"not_an_email_address":{"instruction_type":"error","instruction_message":"Make sure you have entered a valid email address"}},"note_with_tip":{"placeholder_text":"Your note here...","initial":{"instruction_type":"normal","instruction_message":"Attach a note to your tip (optional)"},"empty":{"instruction_type":"normal","instruction_message":"Attach a note to your tip (optional)"},"not_empty_initial":{"instruction_type":"normal","instruction_message":"Attach a note to your tip (optional)"},"saving":{"instruction_type":"normal","instruction_message":"Saving note..."},"success":{"instruction_type":"success","instruction_message":"Note successfully saved!"},"error":{"instruction_type":"error","instruction_message":"Unable to save note note at this time. Please try again."}},"email_for_login_code":{"placeholder_text":"Your email address","initial":{"instruction_type":"normal","instruction_message":"Enter your email to log in."},"success":{"instruction_type":"success","instruction_message":"Enter your email to log in."},"blank":{"instruction_type":"error","instruction_message":"Enter your email to log in."},"empty":{"instruction_type":"error","instruction_message":"Enter your email to log in."}},"login_code":{"initial":{"instruction_type":"normal","instruction_message":"Check your email and enter the login code."},"success":{"instruction_type":"success","instruction_message":"Check your email and enter the login code."},"blank":{"instruction_type":"error","instruction_message":"Check your email and enter the login code."},"empty":{"instruction_type":"error","instruction_message":"Check your email and enter the login code."}},"stripe_all_in_one":{"initial":{"instruction_type":"normal","instruction_message":"Enter your credit card details here."},"empty":{"instruction_type":"error","instruction_message":"Enter your credit card details here."},"success":{"instruction_type":"normal","instruction_message":"Enter your credit card details here."},"invalid_number":{"instruction_type":"error","instruction_message":"The card number is not a valid credit card number."},"invalid_expiry_month":{"instruction_type":"error","instruction_message":"The card's expiration month is invalid."},"invalid_expiry_year":{"instruction_type":"error","instruction_message":"The card's expiration year is invalid."},"invalid_cvc":{"instruction_type":"error","instruction_message":"The card's security code is invalid."},"incorrect_number":{"instruction_type":"error","instruction_message":"The card number is incorrect."},"incomplete_number":{"instruction_type":"error","instruction_message":"The card number is incomplete."},"incomplete_cvc":{"instruction_type":"error","instruction_message":"The card's security code is incomplete."},"incomplete_expiry":{"instruction_type":"error","instruction_message":"The card's expiration date is incomplete."},"incomplete_zip":{"instruction_type":"error","instruction_message":"The card's zip code is incomplete."},"expired_card":{"instruction_type":"error","instruction_message":"The card has expired."},"incorrect_cvc":{"instruction_type":"error","instruction_message":"The card's security code is incorrect."},"incorrect_zip":{"instruction_type":"error","instruction_message":"The card's zip code failed validation."},"invalid_expiry_year_past":{"instruction_type":"error","instruction_message":"The card's expiration year is in the past"},"card_declined":{"instruction_type":"error","instruction_message":"The card was declined."},"missing":{"instruction_type":"error","instruction_message":"There is no card on a customer that is being charged."},"processing_error":{"instruction_type":"error","instruction_message":"An error occurred while processing the card."},"invalid_request_error":{"instruction_type":"error","instruction_message":"Unable to process this payment, please try again or use alternative method."},"invalid_sofort_country":{"instruction_type":"error","instruction_message":"The billing country is not accepted by SOFORT. Please try another country."}}}},"fetched_oembed_html":false}
Trying to use this since it looked like an awesome tool but I have tried the automatic and manual methods without success. Both throw the following error : Sorry something went wrong. Please try again.
Unfortunatly, tried both manual and automatic methods. They both fail with the same error.
Sorry something went wrong. Please try again.
Does your account have the permissions to manage conditional access policies and are you signed into that account?
how can we be sure about security and privacy? and what about GPRD concept?
Are the data uploaded to the idpowertoys site?
how can we be sure that no data are uploaded outside the enterprise?
The information is read from your Azure AD configuration to generate the report. There’s no data stored on the idPowerToys site.
This is nothing even close to being worthy of the PowerToys name. Come on. How about, it’s time for Microsoft to completely finish a product or feature before moving onto the next shiny object? Don’t release unfinished shit Microsoft.
Hi Tony , i have tried with my test account (no azure subscription) with premium p1 license… i have few policies switched on and off…. when i tried Automatic the documents is downloading but with no policies in it
Did the manual generation work? This will at least prove that you can access the conditional access data from the Graph.
I’ve also tried both methods, both fail with “Something went wrong”. App has all of the necessary permissions granted.
The Manual method currently states “NOTE: THE MANUAL MODE IS TEMPORARILY NOT AVAILABLE WHILE A BUG IS BEING FIXED.”
My error, using Graph Explorer:-
“error”: {
“code”: “AccessDenied”,
“message”: “You cannot perform the requested operation, required scopes are missing in the token.”,
That error indicates that your Graph Explorer session doesn’t have the Policy.Read.All permission. Use the Modify Permissions tab to assign and grant consent to the permission and you should be able to retrieve the information.
I don’t know why the developers took the manual mode offline. I guess someone found a problem…
First, thank you Tony for this, it sounds very interesting and i want definitely to try it.
I just tried the both methods as well, for the manual mode i am getting the same error like others.
For the automatic mode the PowerPoint document gets created but only with one site where i can see the tenant ID, tenant name, generated by (my global admin account), generated on.
I think the developers of IdPowerToys are makking some changes. Maybe leave this until next week before trying again.
Love the idea of this! Great work. Any idea on when the manual step will be available again?
None. It’s in the hands of the IdPowerToys developers, and I’m not smart enough to be in that gang…