What it decides

Rule
CA-SCOPE-001
Applies to
entra · conditional-access-policy
Default severity
medium
Basis
documented-guidance

On what authority

Microsoft's sentence is unambiguous: "Calls made by service principals aren't blocked by Conditional Access policies scoped to users. Use Conditional Access for workload identities to define policies that target service principals." A policy including `All users` is the strongest-sounding scope the portal offers, and it is the one this gap is easiest to miss under. An organisation that has read its own policy list and concluded that every sign-in requires multifactor authentication has concluded something the product does not do. This rule states the gap where the policy is, rather than requiring the organisation to hold two features in mind at once.

What it needs to decide

  • conditional_access_policies.included_users

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

  • conditional-access: the Conditional Access policies, named locations and Security Defaults state of one tenant · provider live-validated, slice not live-validated

What a pass does not establish

A PASS HERE IS NARROW AND SAYS ALMOST NOTHING. A policy scoped to a group rather than to all users has exactly the same gap for workload identities; it simply is not the policy an organisation reads as covering everything. This rule fires where the belief forms, not where the gap is.

  • Whether this tenant has a workload identity policy is not read here. This rule reads one policy and does not look for another, so a fail on a tenant that has covered its service principals elsewhere is describing this policy correctly and the tenant incompletely.
  • Microsoft also recommends excluding service accounts from user-scoped policies, so a policy that excludes them is following guidance rather than leaving a gap. The exclusion is not read by this rule.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b8@c2aecc628b21.

Generated from capability-manifest/1.0.0 at 1.0.0b8@c2aecc628b21, contract 1.0.0b8. Every fact on this page is the Engine's; this site publishes it and does not maintain it.