Conditional Access,
managed at fleet scale.
Drift detection, impact analysis, MFA posture, and a safe change-management workflow across every customer Entra tenant you run. One console, every customer, never another "who changed CA101 yesterday?"
Free for up to 3 customer tenants. No credit card. Admin consent in one click.
Built on, for, and around Microsoft Entra
The problem
Every CA change is a guess until someone gets locked out.
The Azure portal shows you policies. It doesn't show you what's changed since last Tuesday, who'd be affected by enabling that policy, or which exec is about to lose access because their travel exception expired silently last night.
You can't see drift
Someone tweaked a CA policy in the portal three weeks ago. You'll find out at the next audit. Or when something breaks.
You can't predict impact
Flipping report-only → enforced is a coin flip. "Should be fine" until the Monday standup with 47 helpdesk tickets.
Exclusions never expire
That 24-hour travel exception from Q1 last year? Still active. So is the contractor who left in March.
What you get
Eight tracks. One console. Every customer.
Built like the things we manage
Multi-tenant isolation, end-to-end auditable.
We're an identity-management product. We treat our own identity model the same way.
- Schema-per-tenant in shared Postgres with row-level security on every shared table
- Customer Graph credentials stored in Supabase Vault, scoped service-role access only
- Custom Access Token Hook injects msp_id into every JWT — RLS scopes everything
- Append-only audit log: UPDATE and DELETE revoked at the grant layer, enforced by pgTAP
- Multi-tenant Entra app reg with admin consent per customer — no shared client secret in your env
create policy tenant_select_own_msp on public.tenant for select using (msp_id = public.current_msp_id()); -- current_msp_id() reads the JWT claim -- injected by the access-token hook — -- you can't see another MSP's tenants -- even with a stolen anon key.