STOP THE CAP: Making Entra ID Conditional Access Make Sense Offline

This report presents CAPSlock, an offline analysis tool for Microsoft Entra ID Conditional Access that consumes ROADrecon data to model policy scope, normalize signals, and simulate sign-in scenarios, clearly separating definitive from signal-dependent enforcement. It supports both targeted “what-if” evaluations and automated permutations to uncover enforcement gaps (e.g., MFA avoidance under specific platforms, locations, or risks), and provides CLI and web interfaces; noted limitations include app grouping resolution and evolving access requirements as AAD Graph deprecates in favor of Microsoft Graph.