Skip to content
Andy Kemp Consulting

Using AKC AUP#

Six steps down the left of the window. Move with Back and Next, or select a step. Nothing changes in your tenant until you deploy.

Step 1: Check the tenant#

Sign in first (top right). AKC AUP then checks, read only:

  • Licence: Microsoft Entra ID P1 or a plan that includes it
  • Your role: Conditional Access Administrator can deploy; Security Reader can look; anything more than needed gets a warning
  • Terms of Use already here, and how close the tenant is to Entra's limit of 40 per tenant
  • Policies that already require terms, so you don't add a second prompt for the same people
  • Your break-glass group: the groups left out of the most active policies, and groups named like one (break glass, emergency)

The break-glass group#

Your emergency access accounts must never be stopped by a Terms of Use prompt. Choose Use this group on a suggestion, or search for it. It's left out of every policy AKC AUP creates, it can't be added as a target, and AKC AUP won't deploy without one.

Step 2: Model#

Model Creates When it fits
Separate member AUP and guest terms (recommended) 2 Terms of Use, 2 policies Most organisations. Guests aren't employees, so they get shorter terms about confidentiality and access. The members policy leaves guests out, so nobody is asked twice.
Members only, guests later 1 Terms of Use, 1 policy Your own people first. Every guest and external user type is left out and isn't asked anything.
One AUP for everyone 1 Terms of Use, 1 policy Small organisations, or where guests are effectively staff.

Changing the model keeps the PDFs and settings you've already chosen where they still fit.

Step 3: Documents#

For each set of terms:

  • PDF: choose the file. AKC AUP checks it's a PDF and under 3 MB, and Open shows it. Large text reads best on phones.
  • Name in the Entra admin centre: what admins see, such as Acceptable Use Policy - Members.
  • Title people see when they sign in, such as Acceptable Use Policy.
  • Language: a language tag such as en-GB. Extra languages can be added in Entra afterwards.

Step 4: Acceptance#

  • People must open the document before they can accept: on by default.
  • Accept on every device: off by default. It needs the device registered in Entra and doesn't work with every app or browser: test it with a small group first.
  • Accept again: never, or every 90 days, 6 months, 1 year or 2 years, counted from when each person last accepted. Every year is usual for an AUP.

Step 5: Who it applies to#

  • Policy names: a prefix in your own numbering (CA010, say), then Apply to the names. Separate policies get a and b: CA010a - Members - All apps - Require AUP acceptance. You can also type any name.
  • Members: All users, or switch it off and search for groups (a pilot group, say). Guests and external users are always left out of the members policy.
  • Guests: every guest and external user type, for all apps.
  • Also leave out: groups to exclude as well as the break-glass group, such as service accounts.

Each policy requires the Terms of Use only, for all apps. Your MFA and device controls stay in your existing policies.

Step 6: Review and deploy#

Every value AKC AUP will create, in one place, with anything that needs fixing listed first.

Switch on: each policy starts report-only. Switch one on here to enforce it straight away, for example guests On and members report-only while you check the sign-in logs. You're asked to confirm anything going On.

Deploy checks nothing with the same names is already in the tenant, creates the Terms of Use, then the policies, and saves a deployment record. If something fails part-way, it offers to roll back what it made.

Changing a deployment#

Choose Change this deployment straight after deploying, or Tools, Change a deployment… and open its record. AKC AUP reads the terms and policies back from Entra by ID, so you start from what's there now, including changes made in the portal. If something important changed there (the break-glass group no longer excluded, or a policy no longer requiring its terms), it tells you, and applying puts it back.

You can change Fixed once created
Each policy: On or report-only, name, who it applies to, who's left out The model
Terms of Use: name, and "must open before accepting" The PDF, the title, the language, per-device and re-acceptance

Entra doesn't allow the fixed settings to change on existing terms. To change them, roll back and deploy new terms.

Step 6 lists the changes, and the button becomes Apply changes. Each change saves a change record; it covers the same items, so you can still roll back from it. Stop changing goes back to a new deployment.

Rolling back#

Choose Roll back straight after a deployment, or Tools, Roll back a deployment… and open its record. AKC AUP removes the policies first, then the Terms of Use (Entra won't delete terms a policy still uses). It only removes what that deployment created.

Removing Terms of Use also removes Entra's record of who accepted them: keep a copy of the acceptances first if you need it for an audit.

Deployment records#

Every deployment, change and rollback is recorded in %LOCALAPPDATA%\AKC\AUP\Records (File, Open the records folder): an HTML page for your audit file, and a JSON file that Change a deployment and Roll back a deployment open. Records hold names, settings, IDs and who deployed, never the PDF itself, and they're never sent anywhere.