The problem
Conditional-access policies govern who can sign in and from where. Auditors ask for evidence that someone actually reviews that posture, and a careless change can lock out an entire organization, which is exactly why this runbook reads and records rather than edits.
What AscendCore does
An admin runs the review from Slack or Teams. AscendCore reads every conditional-access policy (read-only), flags common gaps (disabled or report-only policies, broad exclusions shown as counts only, no enforced MFA for admin roles, legacy authentication not blocked), and posts the posture as a single review card. On approval it records the reviewed findings on the tamper-evident audit chain as access-review evidence, attributed to the approver. If the policies changed between the card and the approval, recording is refused and you re-run the review, so the evidence always describes exactly what the approver saw. No policy is created, changed, or deleted: in v1, policy changes remain manual by design.
Status
Live in production. Runs against a real Microsoft Entra ID tenant today from Slack and Teams: it reads every conditional-access policy (read-only), flags common gaps on one card, and on approval records the reviewed findings on the tamper-evident audit chain as access-review evidence attributed to the approver, refusing to record if the policies changed between the card and the approval. This runbook reads and records only; it creates, changes, or deletes no policy, so remediation stays a deliberate manual step. The gap checks and exclusion threshold are configurable per customer.
