STOP THE CAP: MAKING ENTRA ID CONDITIONAL ACCESS MAKE SENSE OFFLINE

Summary from the TLDR InfoSec newsletter

CAPSlock is an offline Conditional Access Policy (CAP) analysis engine built on ROADrecon that simulates sign-in scenarios without generating tenant artifacts and distinguishes between definitively applied policies and signal-dependent ones. The tool addresses a critical gap in Entra ID assessments, overlapping CAPs create hard-to-reason enforcement behavior, particularly around MFA bypasses and platform-specific policy gaps, by modeling normalization, exclusion logic, and cumulative policy enforcement offline. Both red teamers and defenders should evaluate CAPSlock for CAP auditing workflows, with the caveat that pending AAD Graph deprecation will require elevated Microsoft Graph permissions for future policy collection.