Wave 15 · Identity and Endpoint Expansion Microsoft / Entra / Conditional Access proof Synthetic policy snapshots + exception exports

Conditional Access policy drift, admin exclusions, and device/risk posture that stay operator-readable.

This control plane turns Conditional Access snapshots into one identity-governance surface: report-only admin policies, exclusion sprawl, device-trust gaps, missing sign-in risk coverage, weak session controls, and the remediation packets needed before audit or incident windows drift.

Overview Policy Lane Control Gaps Exception Posture Verification Docs

Commercial Front Door

Conditional Access, identity protection, and tenant-governance operations for platform, IAM, and security teams.
Audit-safe visibility into policy enforcement, exclusions, device trust, and app-targeting posture without exposing tenant credentials.

Proof Layer

Offline posture analyzer + CLI + dashboard surface.
This repo includes a reusable analyzer that reads Conditional Access exports and turns them into owner, control-gap, and remediation packets.

Why it matters

Recruiters looking for Azure / Entra / Conditional Access / Intune / identity governance should see real admin work: policy enforcement, exclusions, device trust, and audit-safe cleanup proof.

Policy Lane

owner · focus · next action

Policy lane	Owner	Status	Related findings	Focus	Next action
Privileged admin lane Privileged protections drifted into report-only mode with exclusion sprawl.	Entra IAM	red	2	Admin policies, exclusions, and role-sensitive sign-in controls	Restore admin enforcement and cut the exclusion list back to monitored emergency accounts.
Device trust lane macOS browser traffic is bypassing the expected device-trust gate.	Endpoint Engineering	red	1	Compliant-device enforcement and unmanaged endpoint containment	Reattach compliant-device logic and verify browser policy targeting.
Risk and session lane Risk and session controls are partially missing in the current policy bundle.	Identity Protection	yellow	3	Sign-in risk coverage, session control, and containment posture	Reintroduce risk enforcement and session restrictions before the next audit window.
App targeting lane New business apps are arriving faster than the baseline policy set covers them.	Application Access	yellow	4	Critical SaaS targeting and rollout completeness	Add uncovered apps to workforce coverage and confirm scope inheritance.