· Conditional Access
A Conditional Access policy that has never been observed against real sign-ins is a guess. CogniAccess runs new policies in report-only mode, reads the sign-in data, resolves the service accounts and exception paths the data reveals, and only then enforces — in waves, with a rollback point at each step.
The reason is structural. In most tenants, policies overlap, exclusions are unclear, and break-glass access is uncertain — which is why enforcement gets delayed: nobody wants to cause a broad sign-in outage. The review behind this position covers tenant configuration, authentication methods, administrative roles, application assignments, named locations, device signals, and sign-in behavior, and organizes Conditional Access into named policy sets, each with a clear purpose, population, control, exception path, and owner.
Delivery then follows the same discipline: report-only testing, pilot groups, staged enforcement, and monitoring during each wave. Emergency access accounts are designed, protected, tested, and documented rather than treated as an afterthought — because the day a policy misbehaves is the day they matter.
Start with the fixed-scope Conditional Access & MFA Review · How the Entra ID service works