Entra Policy Suite documentation · Verified against Entra Policy Suite 2.1.4 on Nov 11, 2026

What Entra Policy Suite does

Conditional Access policies, dynamic groups and access reviews only work when every identity and device carries the right tag. In most tenants nobody can say with confidence which accounts are admins, which are service accounts, which are shared devices or guests - and a label that is wrong or missing quietly takes an account out of the policy that should protect it.

Entra Policy Suite gives every user and device its tags from rules you control, writes them into extension attributes in Entra ID (and in Active Directory for synced users), watches those tags for changes it did not make, and shows the identity gaps in your tenant as a report you can filter. It runs in your own Azure subscription. This is the Community edition.

What you get

Area What it does
Rules One rule per persona and tag type, with its conditions. You edit them on a page that works like a spreadsheet: select, copy and paste to and from Excel, fill down, duplicate, move, switch on and off. See Rules.
Commit queue A saved change waits until an admin commits it. Nothing reaches the directory the moment someone types. See Commit queue.
User and device tagging A job reads every user and device, decides each tag from the rules, and writes only what differs. Cloud users and devices are written through Microsoft Graph; AD-synced users are written in Active Directory by the hybrid worker. See Jobs and runs.
Hybrid worker A small agent on a domain-joined Windows server. It writes the tags of AD-synced users and reads AD for the rules and the identity report. No inbound connection, no password. See Hybrid worker.
Identity report A daily, read-only snapshot of every user and device: MFA, sign-in, licenses, Active Directory and Intune. Each view is a gap with a severity, what it means and how to close it. See Identity report.
Tamper monitor Finds a change to a watched tag that Entra Policy Suite did not make, and alerts you. See Tamper monitor.
Conditional Access overview Every Conditional Access policy matched to its template, with its stage and what differs. A SuperAdmin moves an adopted policy to another stage after seeing what changes. See Conditional Access.
Settings, access and audit Every behavior is a setting with an explanation. Three roles. Every change is in an audit trail. See Settings and Access and audit.

How it works in one picture

  1. Rules decide. A rule says: users whose UPN starts with adm- get the Classification Internal_Admin_Cloud and the Authentication tag Internal_Admin_Cloud_FIDO.
  2. A job plans. On its schedule, the tagging job reads everyone and works out every change, with the old value, the new value and the rule behind it.
  3. The plan is applied. In Preview mode the plan is only recorded. In Apply mode each change is written, and each one is listed on the Tag changes page.
  4. Your policies follow. Dynamic groups read the tags, and your Conditional Access policies target those groups.
  5. The tags are watched. A change that the engine did not make is reported with who made it and what it means.

Who it is for

  • Identity and security teams who run Conditional Access by persona (admins, internal users, guests, service accounts, shared devices, Teams Rooms).
  • Teams that used Entra Policy Suite 1 (the scripts) and want the same rules in a managed service with a web app. Your v1 rule files import as they are. See Move from v1.

The pages of the web app

Menu Page What it is
Overview Overview What needs attention: open tag changes, runs, findings
Overview Get started What Entra Policy Suite needs before it works, checked against your tenant; a SuperAdmin creates what is missing
Overview Import v1 Bring an Entra Policy Suite 1 install over: upload its files, see the plan, approve. See Move from v1.
Tagging Tagging Rules, Tag types, Condition types The rules, the tags they write and what a rule can test. See Rules and Tag types and conditions.
Tagging Test runs Test the rules on the people you pick, see per person why, then go live
Tagging Commit queue, Tag changes, Tamper See Commit queue, Jobs and runs and Tamper monitor
Conditional Access Policies Your policies against their templates: adopt, deploy, edit, clone, stage moves, versions, remove. See Conditional Access.
Conditional Access Groups The groups the policies use: create them, their rules and members, administrative units
Conditional Access Documentation Every policy with its ids resolved, as Excel or CSV
Conditional Access Templates, Template updates The template library of this release, and what a newer library brings - you decide what to take
Conditional Access CA Policy Analyzer Who a policy blocked or challenged in the sign-ins, and why; monitors that mail when users are impacted
Identity report Identity report Users and devices, the gaps by severity, follow-up actions. See Identity report.
Jobs & runs Jobs & schedule, Runs See Jobs and runs
Administration Settings See Settings
Administration Hybrid worker The AD worker: its scheduled task, AD domain, queue, connection test, how to add one. See Hybrid worker.
Administration Optional components What is optional, whether it is on, which rights are missing and the script that adds them
Administration Access, Audit See Access and audit
Administration Backups / Undo The daily backups of your policies and tagging (the newest 30); put something back, undo a change
Administration License Community or Pro: the edition, validity, users against the license, the Pro features
Administration API reference, API and MCP (Pro) The API route by route; with Pro, your own scripts and AI assistants use it with your own sign-in and role

What it is not

  • It does not change Conditional Access on its own or on a schedule. It changes a policy only when a SuperAdmin asks for it, after seeing what changes, with a reason. The Conditional Access page reads your policies and compares them with the template library; from there a SuperAdmin can deploy a template, edit or copy a policy, move it to another stage, promote or roll back a new version, put a policy back from a backup, and delete policies that are off.
  • It is not a replacement for Entra ID Governance. It tags identities so that your own policies and groups can rely on the tags.

Verified against Entra Policy Suite 2.1.4 on 2026-11-11

Verified against Entra Policy Suite 2.1.4 on Nov 11, 2026

Tag types and conditions →