Free · No account required · Browser-local review

Conditional Access Identity Exclusion Audit

Private browser workbench

Import and validate a local CertPilot Conditional Access export. Your CertPilot export is processed only in this browser. Nothing in the export is uploaded to CertPilot.

Record local approvals, calculate deterministic review findings, explicitly save or open a local review file, download the identity inventory CSV and the findings CSV, and print the review evidence using your browser's own print dialog, where you can choose Save as PDF. Review data is processed in this tab and is not uploaded. Nothing is saved automatically. Files you explicitly save, download or print to disk remain there after Reset or closing the tab; you control their destination, protection, backups and sharing. The browser does not connect to Microsoft. This is not a comprehensive security assessment or a compliance guarantee.

Export locally, then review

Download the PowerShell exporter. Inspect the script before running it.
The required PowerShell module is Microsoft.Graph.Authentication. The exporter does not install it automatically; if absent, it stops with prerequisite instructions.
Run the downloaded script locally in PowerShell: .\Export-CertPilotCAIdentityExclusions.ps1 -OutputPath .\certpilot-ca-export.json. You authenticate to Microsoft Graph locally, not through this browser. The output folder must exist and the destination file must not already exist. The exporter will not overwrite it.
The generated cae-export/1.0 JSON remains local. Open that JSON below, review the identity exclusions and record approval information.
Explicitly save a review JSON to reopen later, download CSV evidence, or use Print / Save as PDF as needed. There is no automatic sync or remediation.

If Windows blocks the downloaded script

First confirm that you downloaded it directly from certpilot.app and inspect it. You may then unblock only that specific file: Unblock-File -Path .\Export-CertPilotCAIdentityExclusions.ps1. Do not change execution policy globally or recursively unblock folders. Unblocking does not override your organization's execution policy.

Read-only permissions and validation limits

The local exporter requests Policy.Read.ConditionalAccess, User.ReadBasic.All, GroupMember.Read.All and RoleManagement.Read.Directory, based on documented Microsoft Graph contracts. These permissions have not been independently live-tenant verified. The exporter does not automatically broaden permissions.

Validated offline against documented Microsoft Graph contracts and synthetic responses, not live Microsoft compatibility proof. Actual @odata.type behavior, live permission sufficiency, authentication cache behavior and real tenant execution remain unverified.

This is a point-in-time identity-exclusion inventory and local approval reconciliation, not effective sign-in evaluation, a vulnerability scanner, compliance certification or automated remediation. There is no security score. Incomplete collection remains visible; missing evidence is not a clean result.

Local review workbench

Unsaved local review data is discarded on Reset or exit. No autosave. Reset does not delete review files you saved. Controls appear only after the isolated browser context is confirmed.

Private controls are locked until the privacy boundary is verified. If this message remains, the shell is unavailable.

This boundary concerns the CertPilot application/runtime path only. It does not protect against malicious extensions, a compromised browser or operating system, memory capture, printing, screenshots, copied data or files you save.