Entra Policy Suite documentation · Verified against Entra Policy Suite 2.1.4 on Nov 11, 2026
Security
Entra Policy Suite writes the tags your Conditional Access policies depend on, so it is built to give each part only what it needs and to leave a record of everything it does.
Where it runs and where your data is
- Everything runs in your Azure subscription, in one resource group: the jobs, the web app, the database, the registry, the queues and the Key Vault.
- Rules, runs, tag changes, identity report snapshots, tamper events and the audit trail are kept in your Azure SQL database.
- Nothing is hosted by Invardia. Without a key from Invardia, the Community edition only asks invardia.com once a night which release is approved for its ring; it sends no tenant data.
One identity per part, no client secrets
| Part | Signs in as | Can |
|---|---|---|
| Engine (the jobs and the scheduler) | Its own managed identity | Write the tag attributes on users and devices; read what the rules, the identity report, the tamper monitor and the Conditional Access page need (see Install for every permission); put a run request on a job’s queue, without being able to start a job itself |
| Web app | Its own managed identity | Read the database, record requests and put one wake-up message on one queue. It has no Microsoft Graph or Exchange right and no Azure management right. |
| Hybrid worker | The server’s managed identity (database) and a gMSA (Active Directory) | Write the tag attributes you listed, on user objects, through a permission group granted at the domain root; read AD users and groups |
No identity has a client secret or a certificate to create, store or rotate. The Key Vault holds one key that protects the web app’s sign-in sessions, plus - when Invardia has issued one - the connection key for the Invardia support link, which only the engine can read.
The web app changes nothing by itself
A person’s change in the web app - a rule, a setting, a schedule, a run request, a commit - is recorded with that person’s identity and reason. The engine carries it out after it checks the person’s role at that moment. The web app’s own identity has no right to change the directory or the configuration.
In the database
Each part has its own database role with grants on the tables it uses, and nothing else - none of them is owner, reader or writer of everything. Only the database setup job is the server’s admin, through the admin group, because it creates the schema and the roles; no person needs a database right. The database uses Microsoft Entra authentication only.
Changes are controlled
- Rule changes wait in the Commit queue until an admin commits them; a second approver can be required.
- New or changed rules are proven with a Preview on everyone and an Apply on a test scope before they run on everyone.
- A run whose plan is far larger than usual is held for an admin’s approval.
- Every change is in an append-only audit trail with who, when, why, before and after. See Access and audit.
Conditional Access stays yours
Entra Policy Suite reads your Conditional Access policies. It changes a Conditional Access policy only when a SuperAdmin asks for it, after seeing what changes, with a reason: deploying a template, saving an edit or a copy, moving an adopted policy to another stage, promoting or rolling back a new version, putting a policy back from a backup, or deleting policies that are off. Nothing changes a policy on a schedule. For a stage move, the engine reads the policy again first and makes the change only if it is unchanged since the person looked and your break-glass accounts stay excluded. See Conditional Access.
Tampering is seen
A change to a watched tag that Entra Policy Suite did not make is reported, with who made it when the audit log says so. See Tamper monitor.
Releases
The Community edition is published as releases on GitHub. The launcher checks the download against the SHA-256 digest GitHub publishes for it before it unpacks it; a file that does not match is deleted and the install stops. The Pro launcher from invardia.com takes the release from Invardia after you sign in for your tenant, and checks that Invardia signed it, its size and its SHA-256 the same way. Updates of both editions are checked to be signed by Invardia before they are installed.
Verified against Entra Policy Suite 2.1.4 on 2026-11-11
Verified against Entra Policy Suite 2.1.4 on Nov 11, 2026