Chapter 2: Policy Management

CA Policy Analyzer User Manual

Loading Policies (JSON Import)

Import JSON files exported from the Microsoft Entra admin center or Graph API to register your policies.

1. Click the "Load Policies" button in the left sidebar.
2. A file selection dialog will open. Select your JSON file.
3. A change record input screen will appear. Fill in the following fields:
   • Changed By (required): Records who performed this import.
   • Change Reason (required): Records the reason for this import.
4. Click the "Load" button to add the policies to the list.

Manual Policy Registration

Even without a JSON file, you can create and register policies manually. Click the "New Policy" button and fill in the following fields.

Basic Information

• Policy Name (required): Enter a name to identify the policy.
• State: Select one of Enabled / Report-only / Disabled.

Assignments

• Users: Specify users to include and exclude from the policy scope.
• Roles: Specify roles to include and exclude from the policy scope.
• Groups: Specify groups to include and exclude from the policy scope.

Target Resources

• Applications: Specify applications to include and exclude from the policy scope.

Conditions

• Device Platforms: Windows, iOS, Android, macOS, Linux, etc.
• Client Apps: Browser, mobile apps/desktop clients, legacy authentication clients
• Locations: Conditions based on named locations
• User Risk: Risk level of the user account
• Sign-in Risk: Risk level of the sign-in attempt
• Device Filter: Filtering conditions based on device attributes

Access Controls

• Block: Deny access entirely.
• Grant: Allow access with the following conditions:
  • Require multi-factor authentication (MFA)
  • Require compliant device
  • Require hybrid Azure AD joined device

Session

• Monitor Only: Allow access while monitoring activity.
• Block Download: Restrict file downloads.
• Sign-in Frequency: Set the interval for requiring re-authentication.
• Persistent Browser Session: Configure whether sessions persist after closing the browser.

Editing Policies

You can edit registered policies to modify their configuration.

1. Select the policy you want to edit from the policy list.
2. Click the "Edit" button.
3. Modify the desired fields in the form.
4. Click the "Save" button to confirm your changes.

When you save changes, the modifications are automatically recorded in the change history. You can review who changed what and when at any time.

Deleting Policies

You can remove policies that are no longer needed from the list.

1. Select the policy you want to delete from the policy list.
2. Click the "Delete" button.
3. A confirmation dialog will appear. Select "Yes" to confirm the deletion.

Copying Policies

The copy feature is useful when you want to create a new policy based on an existing one.

1. Select the source policy from the list.
2. Click the "Copy" button.
3. A copy of the policy will be added to the list with the name "[Original Name] - Copy".
4. Edit the copied policy as needed and use it as a new policy.

JSON Export PRO

You can export registered policies as JSON files.

1. Select the policies you want to export from the list (multiple selection is supported).
2. Click the "Export" button.
3. Specify the destination and file name to save the JSON file.

Exported JSON files can be used for reference in other environments or as backups. They can also be re-imported into another CA Policy Analyzer instance.