Microsoft 365 security
Know the moment a Conditional Access rule changes.
Lavawall® watches Microsoft Entra Conditional Access for every added, edited or deleted policy, shows who changed what and when, and keeps a country-based sign-in block in place. It works across every Microsoft 365 tenant you manage from one console.
Last updated
Start my free trial, no credit cardMicrosoft 365 breach detection
Policy change log · before and after values · country sign-in block · optional rollback
See it in the Lavawall® console
Real screens, shown with example data.
Why Conditional Access needs a watcher
Conditional Access is the rulebook for who can sign in to Microsoft 365, from where and on what conditions. One edit can weaken it without anyone noticing, and attackers who gain admin rights know it. Microsoft advises blocking the device code sign-in flow wherever possible and managing any exceptions through Conditional Access, as its Storm-2372 report explains. That advice only holds while the policy stays as you set it. See also what is configuration drift and what is device code phishing.
What Lavawall does
Logs every policy change
Lavawall takes regular snapshots of the tenant configuration and records each difference: the object, whether it was added, modified or deleted, a severity, and who made the change.
Shows before and after
Open any change to see the old and new value of each field, so you can tell a harmless tidy-up from a weakened rule.
Keeps a country block in place
Lavawall proposes the countries a client really works from, using successful sign-ins only, then sets up and keeps the policy that blocks everywhere else. Run it report-only first, give one traveller a dated exception, and know that break-glass accounts are never blocked. If someone edits the policy in the Microsoft admin centre, Lavawall puts it back. See how country blocking works.
Backs out a bad change
With the rollback add-on, plan the rollback of a single change. The plan must be approved before it runs. About configuration backup and rollback.
- Who, what and when for every change
- Before and after values
- Report-only mode before you enforce
- One-person travel exceptions
- Break-glass accounts never blocked
- Optional rollback with approval
Plans and requirements
The Geo Conditional Access Manager is included in Grow, Professional and Complete. Configuration change monitoring is included in Professional and Complete, and rollback is an add-on or included in Complete. See pricing. Conditional Access itself needs Microsoft Entra ID P1 or higher, included in Microsoft 365 Business Premium, and the client's administrator must approve read and write access for the response features.
Frequently asked questions
What is Conditional Access monitoring?
Conditional Access monitoring means watching the Microsoft Entra rules that decide who can sign in, from where and under what conditions, so a weakened or deleted rule is noticed quickly. Lavawall records every Conditional Access change with who made it, what changed and when.
What does Lavawall show when a Conditional Access policy changes?
Lavawall shows the type of object, its name, whether it was added, modified or deleted, a severity and who made the change. Open a change to see the before and after values of each field.
Can Lavawall undo a bad Conditional Access change?
Yes, with the rollback add-on, which is also included in the Complete tier. You plan the rollback of a single change, and the plan must be approved before it runs.
Can Lavawall block sign-ins from countries a client does not work in?
Yes. Lavawall proposes the countries a client works from using successful sign-ins only, you review the list, and Lavawall sets up and keeps the Conditional Access policy that blocks everywhere else. Start in report-only mode to see who would have been blocked.
What Microsoft licence does Conditional Access need?
Conditional Access needs Microsoft Entra ID P1 or higher, which is included in Microsoft 365 Business Premium. The response features also need the client's administrator to approve read and write access.
Which Lavawall plans include Conditional Access monitoring?
The Geo Conditional Access Manager is included in Grow, Professional and Complete. Configuration change monitoring is included in Professional and Complete. See the pricing page for current plans.