Entra Policy Suite settings · Settings > CA Policy Analyzer

CA Policy Analyzer

Key	CAPolicyAnalyzer.Enabled
Where	Settings > CA Policy Analyzer
Type	On / off
Default	Off

What it does

Switches the CA Policy Analyzer on: it reads your Conditional Access policies and the sign-in logs and shows, per user, who a policy blocked or challenged and why - the check before you move a policy to pilot or production. It only READS: it never changes a policy.

When enabled

Analyze now works from the CA Policy Analyzer page, and the monitors you switch on run on their schedules, several side by side, each with its own policies and parameters. An alert mail goes out only when users are impacted.

When disabled

Off (the default): no analysis runs, Analyze now requests are refused, monitors do not start. Earlier analyzes stay readable.

Risk and how to reverse it

None in the tenant: the analyzer has no right and no code to change a Conditional Access policy. It reads sign-in logs (who signed in where), which the analysis pages show to every signed-in role. Reversible.

Requires

Admin. The engine identity's read rights: Policy.Read.All, RoleManagement.Read.Directory, AuditLog.Read.All and GroupMember.Read.All; Entra ID P1 for the sign-in logs.