Lion Cipher Lab
Find the gaps in conditional access policies by replaying a sign-in log
- Identity & Access Management
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Most organisations that use Microsoft Entra ID protect sign-ins with conditional access: a set of if-then rules such as 'if anyone signs in to anything, then require MFA'. The rules are written one at a time, by different people, over years, and nobody ever reads them all together against real traffic. That is how a company ends up with an MFA policy that is switched on and still lets password-only sign-ins through: one policy only covers modern apps, a 'temporary' exclusion group from two years ago still holds six service accounts, the legacy-protocol block was left in report-only mode after…
What you'll learn
- how conditional access policies are built: assignments, conditions, grant controls, state
- how several policies combine: all applicable policies apply, exclude beats include, block wins
- why legacy authentication protocols (IMAP, POP, SMTP AUTH, ActiveSync) slip past MFA policies
- spotting the classic gaps: modern-only client scoping, unknown device platforms, stale exclusion groups, a forgotten report-only policy
- replaying a sign-in log through a policy model to measure coverage before and after a change
- measuring the lockout cost of a security fix instead of guessing it
- when to use the real tools instead: Entra What If, report-only mode, the sign-in log Conditional Access tab
- why a break-glass exclusion is a deliberate, alerted gap and not a mistake
Steps in this lab
- Conditional access from zero: five words you need
- How several policies combine (the rules your model must copy)
- Why replay a log, and when to use the real tools instead
- Set up the folder and generate one week of sign-ins
- Write the policy set as data, traps included
- Build the evaluator: the documented rules, as about 100 lines of Python
- Replay BEFORE: count the sign-ins that got in on a password alone
- Fix it: four changes, each matched to a documented recommendation
- Replay AFTER, and measure what the fix costs
- What this model cannot see (read this before you trust any number)
- The judgment to keep