Skip to content
Andy Kemp Consulting

Security model#

AKC AUP is built to need as little as possible, to show you everything before it changes anything, and to never lock out your emergency access.

Least privilege#

Who Needs When
Deploy, change, roll back Entra Conditional Access Administrator (or Security Administrator) Each deployment
Look only Security Reader (or Global Reader) Checking the tenant
Set-up Entra Cloud Application Administrator (or Application Administrator) Once per tenant

AKC AUP reads your roles from your sign-in, and warns if your account holds Global, Privileged Role, Cloud Application or Application Administrator. None is needed day to day.

Safe by default#

  • Report-only first: every policy is created report-only unless you switch it on in step 6, with a confirmation.
  • Break-glass always excluded: from every policy, every time, including when changing a deployment. No deploy without one.
  • No duplicates: names already in the tenant are refused before anything is created.
  • Nothing it didn't make: rollback only removes the items its own record lists.

Your tenant's own registration#

Tools, Set up this tenant creates AKC AUP's app registration in your tenant: single-tenant, a public client with no secret or certificate, and delegated permissions only (see Before you start). Nothing is registered in, depends on, or is sent to Andy Kemp Consulting's tenant. To stop AKC AUP, delete or disable the AKC AUP enterprise app.

What stays on your PC#

  • Sign-in tokens: in Microsoft's own sign-in library's cache, protected by Windows. Never written to logs.
  • Logs: %LOCALAPPDATA%\AKC\AUP\Logs, with tokens and the PDF content redacted, so they're safe to send.
  • Deployment records: %LOCALAPPDATA%\AKC\AUP\Records, names, settings and IDs only.

Your PDF goes only to your own tenant, as the Terms of Use document.

Updates#

AKC AUP checks downloads.andykemp.com when it starts and offers each update. The download is checked against the SHA-256 published with it before it's used. To stop it updating itself, set ManagedUpdates = 1 (a DWORD) under HKLM\SOFTWARE\Policies\Andy Kemp Consulting\AUP.

Code signing

The beta EXE isn't code-signed yet, so SmartScreen warns the first time. Check the download against the SHA-256 on downloads.andykemp.com.