Skip to content
Andy Kemp Consulting

AKC AUP#

Put your acceptable use policy in front of every user and guest, and prove they accepted it. AKC AUP uploads your AUP as Microsoft Entra Terms of Use and creates the Conditional Access policies that require it, from one Windows app, signed in with a least-privilege account.

Watch the demo Download

AKC AUP 1.0 is out, labelled beta while it's proven on more tenants. See What's new for the latest changes.

What it does#

Most organisations have an AUP, but few can show an auditor that every user and guest has read it. Terms of Use, required by Conditional Access, does exactly that: people see the document at sign-in, accept it, and Entra records who accepted and when. Setting it up well means a PDF for each audience, the right acceptance settings, policies that don't overlap, report-only first, and the break-glass accounts left out. AKC AUP does it in six steps, with every value shown before anything is sent:

1. Check the tenant   Entra ID P1, your role, what's already there, and your break-glass group
        ↓
2. Model              Members and guests apart, members only (guests later), or one for everyone
        ↓
3. Documents          The PDF for each, its name in Entra and the title people see
        ↓
4. Acceptance         Open before accepting, per-device, and how often people accept again
        ↓
5. Who it applies to  All members or chosen groups, every guest type, exclusions, policy names
        ↓
6. Review and deploy  Every value, each policy report-only unless you switch it on, then deploy
        ↓
   Later              Change the deployment in place, or roll it back from its record

Key features#

  • Least privilege: deploying needs Conditional Access Administrator, and Security Reader can check the tenant. Global Administrator isn't needed
  • Break-glass always left out: found for you from your existing policies, excluded from every policy, and no deploy without one
  • Report-only first: every policy starts report-only; switch each one on separately, so guests can be On while members stay report-only
  • Members and guests apart: a member AUP and shorter guest terms, or members only with guests left out entirely
  • Nothing hidden: every value on a review screen; names already in the tenant are refused, not duplicated
  • Change it later: open a deployment, see it as it is in Entra now, and change it in place
  • Evidence: a deployment record in HTML and JSON, with Entra's IDs, for your audit file; roll back from it at any time
  • Your tenant, not ours: its own app registration in your tenant; nothing is sent to Andy Kemp Consulting
  • Updates itself from downloads.andykemp.com, checked against a published SHA-256

Where to start#

  1. Before you start: what you need, and setting up your tenant once.
  2. Quick start: a member AUP and guest terms, from download to the first acceptance.
  3. Using AKC AUP: every step in detail, changing a deployment and rolling back.