Identity
Conditional Access changes managed through pull requests
Converted portal-managed Conditional Access policies into Terraform so identity changes could be reviewed, approved, and traced before they reached the tenant.
The problem
Conditional Access policies controlled how users and administrators reached business systems, but changes were made directly in the Entra admin center. The tenant showed the current configuration, not the reasoning, review, or history behind each change.
How we worked
-
Assess. We inventoried the existing Conditional Access policies through Microsoft Graph and reviewed their users, groups, applications, conditions, exclusions, and grant controls. This established the live tenant as the starting point and surfaced policy coverage that needed attention.
-
Codify. We imported the existing policies into Terraform without redesigning them during the move. The configuration created a version-controlled representation of the tenant before policy modernization began.
-
Operationalize. We built a GitHub Actions workflow to validate, plan, and apply the Terraform configuration. Proposed policy changes moved through pull requests and approvals, giving reviewers a visible record of what would change before it reached Entra ID.
-
Enable. The identity team gained one delivery path for proposing and reviewing Conditional Access changes. Policy configuration, review history, and ownership were visible together instead of being split between the portal and separate approval records.
The outcome
Conditional Access changes moved from direct portal edits to pull-request review. The deployed policy configuration and its change history became visible in version control, making sensitive identity changes easier to review and trace.