Conditional Access policies

What this page does not show

This inspection does not say who a policy applies to. It reads definitions. A definition names principals and conditions; a sign-in is where a policy takes effect or does not. Nothing on this page, and nothing the command prints, establishes any of the following. The inspection prints the same list itself, on every run.

• Whether a policy applies to a given sign-in. That depends on every condition at that moment, and a definition is not a sign-in.
• Who is in a group or holds a role a policy names. No group or role was expanded, so a count of groups is not a count of people.
• What several policies do together. They combine at sign-in, and this reads each on its own.
• Whether anybody is left outside every policy. That needs every user and every membership, which were not read.

So a row that reads enforced and every user is a statement about one policy's text. It is not a statement about any person, and it is not a statement about the tenant.

The command

The inspection reaches no tenant, so no tenant can verify it: it stands on the one collection it reads, and its label is that collection's.

The command that feeds it

m365g entra ca list reads the Conditional Access policies of one tenant, with its named locations and its Security Defaults state. The permission recorded for it is Policy.Read.All, and it reads Microsoft Graph with a token the operator supplies, or with a certificate.

m365g entra ca list --tenant-url https://contoso-admin.sharepoint.com --evidence-out ./evidence/ca
m365g governance inspect ca-coverage --evidence ./evidence

The first command reaches a tenant. The second does not, and gives the same inspection every time it is run over the same evidence.

What it prints

Five policies, written for this page:

Whom does each Conditional Access policy name, whom does it leave out, and is it enforced?

Require MFA for all users
  id               policy-id-0001
  in force         enforced  (state: enabled)
  static scope     every user, with exclusions
  includes         users 0 · groups 0 · roles 0 · guests no
  excludes         users 2 · groups 1 · roles 0
  narrowed by      nothing else
  controls         mfa

Block legacy authentication
  id               policy-id-0002
  in force         report-only  (state: enabledForReportingButNotEnforced)
  static scope     every user
  includes         users 0 · groups 0 · roles 0 · guests no
  excludes         users 0 · groups 0 · roles 0
  narrowed by      clientAppTypes
  controls         block

Require a compliant device, pilot
  id               policy-id-0003
  in force         off  (state: disabled)
  static scope     named principals
  includes         users 0 · groups 1 · roles 0 · guests no
  excludes         users 0 · groups 0 · roles 0
  narrowed by      nothing else
  controls         compliantDevice

Finance from outside the office
  id               policy-id-0004
  in force         enforced  (state: enabled)
  static scope     named principals, with exclusions
  includes         users 0 · groups 1 · roles 0 · guests no
  excludes         users 0 · groups 0 · roles 1
  narrowed by      locations, platforms
  controls         mfa, compliantDevice

Guests sign in with MFA
  id               policy-id-0005
  in force         enforced  (state: enabled)
  static scope     named principals
  includes         users 0 · groups 0 · roles 0 · guests yes
  excludes         users 0 · groups 0 · roles 0
  narrowed by      applications
  controls         mfa

5 Conditional Access policies in the evidence:
  enforced: 3
  off: 1
  report-only: 1

Not established by this inspection:
  - whether a policy applies to a given sign-in: that depends on every condition at that moment, and a definition is not a sign-in
  - who is in a group or holds a role a policy names: no group or role was expanded, so a count of groups is not a count of people
  - what several policies do together: they combine at sign-in, and this reads each on its own
  - whether anybody is left outside every policy: that needs every user and every membership, which were not read

From 5 evidence documents, sha256:0f6abee34065…, collected 2026-11-10T09:50:00Z to 2026-11-10T09:50:00Z.

The counts at the end are the number of policies in each state, named for the state they count. They are not added into anything, and no policy is ranked against another.

Whether a policy is in force

The inspection translates the service's three policy states into three words, and prints the service's own value beside each, so the translation can be undone.

• enforced is the state enabled. Microsoft documents that the policy is evaluated at sign-in and its controls are applied when its conditions hold.
• report-only is the state enabledForReportingButNotEnforced. Microsoft documents that the policy is evaluated at sign-in and the result is logged, and its controls are not applied. Block legacy authentication above blocks nothing.
• off is the state disabled. The policy is not evaluated.
• not-established is any other value, or a policy whose definition was not read. The value is named and is not guessed at.

in force describes the policy. It does not describe a sign-in: an enforced policy does nothing at a sign-in its conditions do not match.

The static scope

static scope is the user scope written in the definition, in one of three phrases, each with , with exclusions added when the definition leaves anybody out.

• every user: the definition includes all users.
• named principals: the definition names users, groups, roles or guests.
• nobody: the definition names no one.

Under it are two lines of counts: what the definition includes and what it excludes, as users, groups and roles, and whether guests are included.

A count of groups is not a count of people. Finance from outside the office includes 1 group and excludes 1 role. The group may hold three people or three thousand, and the role may be held by anyone: neither was expanded. The service resolves both at sign-in, and the inspection states the relation it did not make: group or role -> its members: NOT JOINED.

An exclusion is a count too. Require MFA for all users reads every user, with exclusions: 2 users and 1 group are left out. Who they are, and how many people the group holds, is not in the inspection.

What else narrows a policy

narrowed by lists the other conditions the definition sets: applications, locations, platforms, client application types, sign-in risk, user risk, devices and the rest. A condition that is set to everything is not listed, because it narrows nothing. nothing else means the user scope is the only condition.

Finance from outside the office is narrowed by locations, platforms. It names one group, and even for that group it takes effect only at a sign-in from a location and a platform its definition matches. The inspection lists which conditions are set. It does not evaluate them.

One policy

--policy-id ID shows one policy, by its identifier, which every view prints: the id line of the text view, and the native_id column of the others.

m365g governance inspect ca-coverage --evidence ./evidence --policy-id policy-id-0004

Where policy-id-0004 stands, a run takes the policy's own identifier. The count line still counts every policy in the evidence, and the states under it count the ones shown. An identifier that matches no policy prints Nothing in this evidence matches what was asked for. and is reported at the head of what is not established.

--output csv and --output md give one row per policy, with the columns name, native_id, in_force, static_scope, includes_users, includes_groups, includes_roles, includes_guests, excludes_users, excludes_groups, excludes_roles, narrowed_by and controls.

A refused read is not a tenant with no policy

When the read of the policies was refused, the evidence holds a document that says so and no policy. The inspection prints no row, and puts the refusal first among what it does not establish:

Whom does each Conditional Access policy name, whom does it leave out, and is it enforced?

No Conditional Access policy is in this evidence.

0 Conditional Access policies in the evidence:

Not established by this inspection:
  - the policies themselves: the read was refused, so an empty list here is not a tenant with no policy
  - whether a policy applies to a given sign-in: that depends on every condition at that moment, and a definition is not a sign-in
  - who is in a group or holds a role a policy names: no group or role was expanded, so a count of groups is not a count of people
  - what several policies do together: they combine at sign-in, and this reads each on its own
  - whether anybody is left outside every policy: that needs every user and every membership, which were not read

From 1 evidence documents, sha256:43fb7ff001fa…, collected 2026-11-10T09:50:00Z to 2026-11-10T09:50:00Z.

0 Conditional Access policies in the evidence is a statement about the evidence. The line under Not established is what keeps it from being read as a statement about the tenant.