Entra Policy Suite settings

A short name for this install, shown in the header of every page and in the subject of every alert mail, so people can tell production from test at a glance. When this install reports to Invardia, the name Invardia ke...

The tenant's name as people know it, shown in the page header next to the tenant id and in alert mails.

The time zone the job schedules are read in: 'daily 01:00' means 01:00 in this time zone, summer time included. The pages always show times in your browser's local time, whatever this is set to.

Whether the web app asks for a note (kept in the audit trail) before it sends an action. The action, who did it and when are always in the audit trail; the note is the only optional part.

Switches the user tagging feature on: the job that evaluates the user rules and gives every user their tags (persona, classification, authentication ...) in extension attributes.

What a SCHEDULED user tagging run does. A Run now request from the Jobs page says its own mode.

Besides the schedule, tag a NEW or CHANGED user within about 5 minutes: only the users whose rule properties changed (a Graph delta of exactly those properties), not everyone.

Users that the tagging job never touches - e.g. a directory sync service account. They are left out before the plan is made.

Switches the device tagging feature on: the job that evaluates the device rules and writes each device's tags to its extension attributes in Entra ID.

What a SCHEDULED device tagging run does. A Run now request says its own mode.

Besides the schedule, tag a NEW or CHANGED device within about 5 minutes: only the devices whose rule properties changed (a Graph delta of exactly those properties), not every device.

Devices that the tagging job never touches - e.g. a directory sync service account. They are left out before the plan is made.

Whether the monitor puts the engine's value back by itself after every foreign change it finds, instead of waiting for an admin to choose Accept or Restore.

Switches the CA Policy Analyzer on: it reads your Conditional Access policies and the sign-in logs and shows, per user, who a policy blocked or challenged and why - the check before you move a policy to pilot or produ...

How the Conditional Access policies target groups (v1: Dynamic_Using_Tags, Manual_Assignment_Advanced or Manual_Assignment_Simple), imported from the v1 configuration. The Conditional Access page uses it to know which...

The name of the authentication strength that requires FIDO2, imported from the v1 configuration. The Conditional Access page expects it in the templates that require FIDO2.

The name of the authentication strength that requires Windows Hello for Business, imported from the v1 configuration. The Conditional Access page expects it in the templates that require it.

The name of the named location that lists the countries sign-ins are blocked from, imported from the v1 configuration. The Conditional Access page expects it in the template that blocks those countries.

Switches the daily named-locations job on (v1's EntraNamedLocations_AzureNetworkServiceTags.ps1): for each service tag in the list (v1's CSV, imported on the Import v1 page) it reads the tag's IP prefixes and keeps th...

The Azure region whose service tags become named locations (v1 used westeurope, hard-coded). Set by the v1 import.

Switches the identity report on: a daily snapshot of every user and device - MFA, sign-in, licenses, AD, devices - shown on the Identity page as gap views with filters and pivots. Read only: nothing in the tenant or A...

How many report snapshots the database keeps (the newest ones). The Identity page can show any kept snapshot and how the gap counts changed.

Sends the report as an Excel workbook (v1's sheets plus the gap views) after every run, with the open High / Medium gaps in the mail - to 'Who gets the workbook', or the alert recipients when that is empty.

The addresses the identity report workbook goes to (v1: $global:Mail_Identity_Maintenance_TO), e.g. the identity team rather than the security alert list.

The per-user device counts (iPhone / iPad / Android / Windows, company / personal) and the smartphone flags only count Intune devices that synced in this many days. The Devices list always shows every device.

The view "No sign-in for 90 days": enabled users of the active classifications with no cloud and no AD sign-in in this many days.

The view "No sign-in for a year": the same as the inactive view, with this longer window.

The view "Guests without a recent sign-in": enabled guests with no cloud sign-in in this many days.

The view "Active without MFA" leaves out users whose hire date (the hire date attribute) is more than this many days in the future - they have not started yet. A user without a valid hire date is always shown.

The extension attribute that holds a user's hire (start) date, read by the "Active without MFA" view.

Which AD location is right for an AD-synced user (views 'AD users in the right / wrong OU' and the shared device user views). A regular expression matched against the user's on-premises distinguished name (e.g. OU=Use...

Which AD location is right for an AD-synced service account. A regular expression matched against the user's on-premises distinguished name (e.g. OU=Users,OU=Corp). Empty: nobody is validated by this rule.

Which AD location is right for a shared user (a column of the user list). A regular expression matched against the user's on-premises distinguished name (e.g. OU=Users,OU=Corp). Empty: nobody is validated by this rule.

Which AD location is right for a shared mailbox account (a column of the user list). A regular expression matched against the user's on-premises distinguished name (e.g. OU=Users,OU=Corp). Empty: nobody is validated b...

Users the report never lists, by UPN or display name (wildcards allowed). v1 left out the directory synchronization account.

Pro. The passkey rollout groups the users by this column of the identity report - one of your tag columns (the classification tag by default).

Pro. After the identity report runs, each persona that has an owner (set on the passkey rollout page) gets at most one mail a day: how many are ready, the target date, and the people who still need a passkey or anothe...

Pro. A user or guest whose last sign-in (interactive, non-interactive or on-premises) is older than this many days is on the stale identities list for review.

Pro. An account that has never signed in and was created more than this many days ago is on the stale identities list for review.

The hybrid worker reports every 5 minutes. When a worker has not reported for this many minutes, Administration > Hybrid worker and the Overview show it as late, with how long ago it last reported.

For several Active Directory forests or domains (v1 ran its scripts once per environment: Internal_Prod, DMZ_Prod, Internal_Dev, Internal_Test). Each line sends the AD changes of users whose on-premises user principal...

How much the run log of user tagging keeps (v1: each script's Verbose / Debug switch).

How much the run log of device tagging keeps (v1: each script's Verbose / Debug switch).

How much the run log of the identity report keeps (v1: each script's Verbose / Debug switch).

How much the run log of the CA Policy Analyzer keeps (v1: each script's Verbose / Debug switch).

How much the run log of the named locations job keeps (v1: each script's Verbose / Debug switch).

How much the run log of the Invardia telemetry keeps (v1: each script's Verbose / Debug switch).

How much the run log of the update job keeps (v1: each script's Verbose / Debug switch).

How much the run log of the backup job keeps (v1: each script's Verbose / Debug switch).

How long the lines of every run log are kept. The run records (what ran, when, its counts) and the audit trail are not removed.

Once a month the CaOptions job reads Microsoft Graph: the values every Conditional Access field allows (Graph v1.0's published schema) and your tenant's authentication strengths, named locations, terms of use and dire...

Pro, license optimization: a license on a user with no sign-in (cloud, non-interactive or AD) in this many days - or none ever - is listed as unused and priced as a saving. A license on a disabled account is always li...