[{"data":1,"prerenderedAt":4598},["ShallowReactive",2],{"post:\u002F2026\u002F08\u002F05\u002Fintune-conditional-access-policies-that-don-t-lock-out-your-help-desk\u002F":3},{"post":4,"newer":4546,"older":4556,"related":4566,"series":4596},{"id":5,"title":6,"body":7,"canonical":4528,"categories":4529,"date":4531,"description":4532,"extension":4533,"featured":4534,"hero":4535,"image":4535,"meta":4536,"navigation":1267,"path":4537,"readingTime":793,"seo":4538,"series":4535,"seriesOrder":4535,"sites":4539,"source":4535,"stem":4540,"tags":4541,"updated":4535,"url":4544,"__hash__":4545},"blog\u002Fblog\u002F2026\u002F08\u002F05\u002Fintune-conditional-access-policies-that-don-t-lock-out-your-help-desk.md","Intune: Conditional Access Policies That Don't Lock Out Your Help Desk",{"type":8,"value":9,"toc":4509},"minimark",[10,14,17,22,25,71,74,81,116,123,127,130,135,205,215,219,273,280,284,337,347,351,402,408,412,465,472,476,533,536,540,599,606,610,656,843,846,1018,1025,1029,1064,3308,3314,3322,3326,3347,3354,3357,3401,3450,3461,3465,3472,3528,3542,3573,3589,4267,4274,4278,4281,4327,4331,4334,4360,4375,4383,4387,4505],[11,12,13],"p",{},"The scariest Conditional Access policy I've ever reviewed wasn't scary because it was too weak. It was scary because it was strong enough to lock out the account that would have fixed it. Requiring compliant devices for every application, for every user, with no break-glass path and no staged rollout, is the kind of policy that reads perfectly in a design document and fails the first time a device compliance signal lags behind reality. Microsoft's own troubleshooting guide lists \"all users, all resources, require device to be marked as compliant\" as a configuration not to use, because an admin without an enrolled device is blocked from getting back in to change it.",[11,15,16],{},"Building Conditional Access and Intune compliance policies that hold up means designing for the failure mode from the start. Below is the baseline I'd put in front of any tenant: seven actual policies modeled on Microsoft's documented templates, the Graph JSON and PowerShell to create them in report-only mode, the queries to read the results, and the access your help desk needs so a block becomes a ticket they can close.",[18,19,21],"h2",{"id":20},"emergency-access-accounts-come-first","Emergency access accounts come first",[11,23,24],{},"Microsoft's current guidance on emergency access accounts is more specific than \"two accounts with long passwords in a safe,\" and it changed in ways that matter:",[26,27,28,45,51,61],"ul",{},[29,30,31,35,36,40,41,44],"li",{},[32,33,34],"strong",{},"At least two cloud-only accounts"," on the ",[37,38,39],"code",{},"*.onmicrosoft.com"," domain, not federated or synced from on-premises, with Global Administrator assigned ",[32,42,43],{},"active permanent"," (not PIM-eligible).",[29,46,47,50],{},[32,48,49],{},"Passwordless, phishing-resistant authentication",": a FIDO2 passkey (recommended) or certificate-based authentication. These satisfy the mandatory MFA requirement for Azure and admin portals, and they should be a different method from the one your everyday admins use.",[29,52,53,56,57,60],{},[32,54,55],{},"Exclude them from Conditional Access policies that block or restrict sign-in."," Report-only policies don't block access and don't need the exclusion. Microsoft recommends a dedicated group (for example ",[37,58,59],{},"EmergencyAccess",") and excluding that group.",[29,62,63,66,67,70],{},[32,64,65],{},"Alert on every sign-in"," and ",[32,68,69],{},"test them at least every 90 days",".",[11,72,73],{},"The mistake I see most often isn't skipping this. Most tenants have break-glass accounts. It's excluding them from the wrong policies. An account excluded from the MFA requirement but still caught by a device compliance policy is not a break-glass account; it's an account that fails at exactly the moment Intune is the thing that's broken. Exclude the group from every enforced policy, then audit that it stays excluded (the drift script linked at the end checks this).",[11,75,76,77,80],{},"The alert Microsoft documents is a Log Analytics query on ",[37,78,79],{},"SigninLogs"," that fires on any result, wired to an Azure Monitor alert rule with a threshold of 0:",[82,83,88],"pre",{"className":84,"code":85,"language":86,"meta":87,"style":87},"language-kusto shiki shiki-themes github-dark","\u002F\u002F Any sign-in by an emergency access account (replace with your accounts' object IDs)\nSigninLogs\n| where UserId == \"\u003Cemergency-account-1-object-id>\" or UserId == \"\u003Cemergency-account-2-object-id>\"\n| project TimeGenerated, UserPrincipalName, UserId, IPAddress, ResultType, ResultDescription\n","kusto","",[37,89,90,98,104,110],{"__ignoreMap":87},[91,92,95],"span",{"class":93,"line":94},"line",1,[91,96,97],{},"\u002F\u002F Any sign-in by an emergency access account (replace with your accounts' object IDs)\n",[91,99,101],{"class":93,"line":100},2,[91,102,103],{},"SigninLogs\n",[91,105,107],{"class":93,"line":106},3,[91,108,109],{},"| where UserId == \"\u003Cemergency-account-1-object-id>\" or UserId == \"\u003Cemergency-account-2-object-id>\"\n",[91,111,113],{"class":93,"line":112},4,[91,114,115],{},"| project TimeGenerated, UserPrincipalName, UserId, IPAddress, ResultType, ResultDescription\n",[11,117,118,119,122],{},"One more thing belongs in the break-glass plan now: ",[32,120,121],{},"Microsoft-managed policies",". Microsoft creates policies such as \"Block legacy authentication,\" \"Multifactor authentication for all users,\" and \"Multifactor authentication for admins accessing Microsoft Admin Portals\" in your tenant in report-only, and enables them no less than 30 days later if you leave them there (with email and Message center notice two weeks ahead). You can't rename or delete them, but you can exclude identities and set them to Off. Exclude your emergency access group from them like any other policy, and decide deliberately whether they or your own policies own each control.",[18,124,126],{"id":125},"seven-baseline-policies-all-starting-in-report-only","Seven baseline policies, all starting in report-only",[11,128,129],{},"Every policy below starts in report-only, excludes the emergency access group, and uses a numbered naming convention so sign-in logs, scripts, and conversations can refer to \"CA003\" without ambiguity. Each one maps to a Microsoft template article (listed in the references).",[131,132,134],"h3",{"id":133},"ca001-admins-require-phishing-resistant-mfa","CA001: Admins require phishing-resistant MFA",[136,137,138,151],"table",{},[139,140,141],"thead",{},[142,143,144,148],"tr",{},[145,146,147],"th",{},"Setting",[145,149,150],{},"Value",[152,153,154,163,173,181,189,197],"tbody",{},[142,155,156,160],{},[157,158,159],"td",{},"Users: include",[157,161,162],{},"Directory roles: Global, Application, Authentication, Billing, Cloud Application, Conditional Access, Exchange, Helpdesk, Password, Privileged Authentication, Privileged Role, Security, SharePoint, and User Administrator",[142,164,165,168],{},[157,166,167],{},"Users: exclude",[157,169,170,172],{},[37,171,59],{}," group",[142,174,175,178],{},[157,176,177],{},"Target resources",[157,179,180],{},"All resources",[142,182,183,186],{},[157,184,185],{},"Conditions",[157,187,188],{},"None",[142,190,191,194],{},[157,192,193],{},"Grant",[157,195,196],{},"Require authentication strength: Phishing-resistant MFA",[142,198,199,202],{},[157,200,201],{},"Initial state",[157,203,204],{},"Report-only",[11,206,207,208,66,211,214],{},"Note ",[32,209,210],{},"Helpdesk Administrator",[32,212,213],{},"Password Administrator"," on that list: your help desk is in scope. Microsoft's caution is blunt: enabling this before administrators register phishing-resistant methods \"risks locking you out of your tenant.\" Issue a Temporary Access Pass so each tech can register a passkey or Windows Hello for Business, and watch report-only results until every admin shows success. Conditional Access only targets built-in role assignments; administrative-unit-scoped and custom roles aren't enforced, so a help desk built on a custom role needs a group-based policy instead.",[131,216,218],{"id":217},"ca002-block-legacy-authentication","CA002: Block legacy authentication",[136,220,221,229],{},[139,222,223],{},[142,224,225,227],{},[145,226,147],{},[145,228,150],{},[152,230,231,238,247,253,260,267],{},[142,232,233,235],{},[157,234,159],{},[157,236,237],{},"All users",[142,239,240,242],{},[157,241,167],{},[157,243,244,246],{},[37,245,59],{}," group, plus any account that must keep legacy auth for now",[142,248,249,251],{},[157,250,177],{},[157,252,180],{},[142,254,255,257],{},[157,256,185],{},[157,258,259],{},"Client apps: Exchange ActiveSync clients and Other clients only",[142,261,262,264],{},[157,263,193],{},[157,265,266],{},"Block access",[142,268,269,271],{},[157,270,201],{},[157,272,204],{},[11,274,275,276,279],{},"Before enforcing, filter the sign-in logs (interactive and non-interactive tabs) on ",[32,277,278],{},"Client app"," for the legacy protocols to find the multifunction printers and old scripts still using them.",[131,281,283],{"id":282},"ca003-all-users-require-mfa","CA003: All users require MFA",[136,285,286,294],{},[139,287,288],{},[142,289,290,292],{},[145,291,147],{},[145,293,150],{},[152,295,296,302,311,318,324,331],{},[142,297,298,300],{},[157,299,159],{},[157,301,237],{},[142,303,304,306],{},[157,305,167],{},[157,307,308,310],{},[37,309,59],{}," group; Directory Synchronization Accounts role if you run Entra Connect or Cloud Sync",[142,312,313,315],{},[157,314,177],{},[157,316,317],{},"All resources, with no exclusions",[142,319,320,322],{},[157,321,185],{},[157,323,188],{},[142,325,326,328],{},[157,327,193],{},[157,329,330],{},"Require authentication strength: Multifactor authentication",[142,332,333,335],{},[157,334,201],{},[157,336,204],{},[11,338,339,340,66,343,346],{},"Microsoft recommends this exact baseline (all users, all resources, no app exclusions). Don't combine ",[32,341,342],{},"Require multifactor authentication",[32,344,345],{},"Require authentication strength"," in one policy; that combination isn't supported. If you use external authentication methods, use the plain MFA grant instead, because they aren't compatible with authentication strengths.",[131,348,350],{"id":349},"ca004-require-mfa-for-azure-management","CA004: Require MFA for Azure management",[136,352,353,361],{},[139,354,355],{},[142,356,357,359],{},[145,358,147],{},[145,360,150],{},[152,362,363,369,377,384,390,396],{},[142,364,365,367],{},[157,366,159],{},[157,368,237],{},[142,370,371,373],{},[157,372,167],{},[157,374,375,172],{},[37,376,59],{},[142,378,379,381],{},[157,380,177],{},[157,382,383],{},"Windows Azure Service Management API",[142,385,386,388],{},[157,387,185],{},[157,389,188],{},[142,391,392,394],{},[157,393,193],{},[157,395,342],{},[142,397,398,400],{},[157,399,201],{},[157,401,204],{},[11,403,404,405,407],{},"The resource is still called ",[32,406,383],{}," in the picker (Azure Government Cloud Management API in Azure Government). It covers Azure Resource Manager and the Azure portal, which includes the Microsoft Entra admin center, and it indirectly affects Azure CLI and Azure PowerShell. It does not apply to Microsoft Graph PowerShell, and it no longer covers Azure DevOps.",[131,409,411],{"id":410},"ca005-secure-security-info-registration","CA005: Secure security info registration",[136,413,414,422],{},[139,415,416],{},[142,417,418,420],{},[145,419,147],{},[145,421,150],{},[152,423,424,430,439,446,453,459],{},[142,425,426,428],{},[157,427,159],{},[157,429,237],{},[142,431,432,434],{},[157,433,167],{},[157,435,436,437,172],{},"All guest and external users; ",[37,438,59],{},[142,440,441,443],{},[157,442,177],{},[157,444,445],{},"User actions: Register security information",[142,447,448,450],{},[157,449,185],{},[157,451,452],{},"Locations: include any location, exclude all trusted locations",[142,454,455,457],{},[157,456,193],{},[157,458,330],{},[142,460,461,463],{},[157,462,201],{},[157,464,204],{},[11,466,467,468,471],{},"New hires can't satisfy MFA before they've registered anything, so this policy assumes the help desk issues ",[32,469,470],{},"Temporary Access Pass"," credentials, which satisfy MFA requirements. Microsoft's docs also flag a date to plan around: starting July 6, 2026, policies targeting Register security information also apply to Windows Hello for Business and macOS Platform SSO credential registration, so a grant control that a new Windows user can't meet now blocks Windows Hello enrollment too. Test those flows with a pilot group.",[131,473,475],{"id":474},"ca006-windows-devices-must-be-compliant-or-hybrid-joined","CA006: Windows devices must be compliant or hybrid joined",[136,477,478,486],{},[139,479,480],{},[142,481,482,484],{},[145,483,147],{},[145,485,150],{},[152,487,488,494,503,509,516,527],{},[142,489,490,492],{},[157,491,159],{},[157,493,237],{},[142,495,496,498],{},[157,497,167],{},[157,499,500,502],{},[37,501,59],{}," group; Directory Synchronization Accounts role",[142,504,505,507],{},[157,506,177],{},[157,508,180],{},[142,510,511,513],{},[157,512,185],{},[157,514,515],{},"Device platforms: Windows",[142,517,518,520],{},[157,519,193],{},[157,521,522,523,526],{},"Require device to be marked as compliant ",[32,524,525],{},"or"," Require Microsoft Entra hybrid joined device (require one of the selected controls)",[142,528,529,531],{},[157,530,201],{},[157,532,204],{},[11,534,535],{},"This is modeled on Microsoft's \"compliant or hybrid joined\" template, scoped to Windows while it runs in report-only. That scoping is deliberate: Microsoft warns that report-only policies requiring a compliant device can prompt macOS, iOS, and Android users to pick a device certificate on every sign-in, and recommends excluding those platforms from report-only compliance policies. Add them with their own policy once you're ready to enforce. The compliant-device control doesn't block Intune enrollment itself, so new devices can still enroll.",[131,537,539],{"id":538},"ca007-mfa-and-reauthentication-for-risky-sign-ins","CA007: MFA and reauthentication for risky sign-ins",[136,541,542,550],{},[139,543,544],{},[142,545,546,548],{},[145,547,147],{},[145,549,150],{},[152,551,552,558,566,572,579,585,593],{},[142,553,554,556],{},[157,555,159],{},[157,557,237],{},[142,559,560,562],{},[157,561,167],{},[157,563,564,172],{},[37,565,59],{},[142,567,568,570],{},[157,569,177],{},[157,571,180],{},[142,573,574,576],{},[157,575,185],{},[157,577,578],{},"Sign-in risk: High and Medium",[142,580,581,583],{},[157,582,193],{},[157,584,330],{},[142,586,587,590],{},[157,588,589],{},"Session",[157,591,592],{},"Sign-in frequency: Every time",[142,594,595,597],{},[157,596,201],{},[157,598,204],{},[11,600,601,602,605],{},"This one needs Microsoft Entra ID P2. Users who aren't registered for MFA get blocked on a risky sign-in with ",[37,603,604],{},"AADSTS53004",", because the policy prevents registering MFA during a risky session. That's a help desk call you can predict: CA005 plus TAP is how the user gets registered before it happens.",[18,607,609],{"id":608},"one-policy-as-microsoft-graph-json","One policy as Microsoft Graph JSON",[11,611,612,613,616,617,620,621,620,624,620,627,630,631,634,635,637,638,620,641,630,644,647,648,651,652,655],{},"A Conditional Access policy is a ",[37,614,615],{},"conditionalAccessPolicy"," resource with ",[37,618,619],{},"displayName",", ",[37,622,623],{},"state",[37,625,626],{},"conditions",[37,628,629],{},"grantControls",", and ",[37,632,633],{},"sessionControls",". The ",[37,636,623],{}," values are ",[37,639,640],{},"enabled",[37,642,643],{},"disabled",[37,645,646],{},"enabledForReportingButNotEnforced"," (report-only). This is CA002 as a ",[37,649,650],{},"POST"," to ",[37,653,654],{},"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fidentity\u002FconditionalAccess\u002Fpolicies",":",[82,657,661],{"className":658,"code":659,"language":660,"meta":87,"style":87},"language-json shiki shiki-themes github-dark","{\n  \"displayName\": \"CA002 - All users - Block legacy authentication\",\n  \"state\": \"enabledForReportingButNotEnforced\",\n  \"conditions\": {\n    \"users\": {\n      \"includeUsers\": [\"All\"],\n      \"excludeGroups\": [\"\u003Cemergency-access-group-object-id>\"]\n    },\n    \"applications\": {\n      \"includeApplications\": [\"All\"]\n    },\n    \"clientAppTypes\": [\"exchangeActiveSync\", \"other\"]\n  },\n  \"grantControls\": {\n    \"operator\": \"OR\",\n    \"builtInControls\": [\"block\"]\n  }\n}\n","json",[37,662,663,669,685,697,705,713,728,742,748,756,768,773,791,797,805,818,831,837],{"__ignoreMap":87},[91,664,665],{"class":93,"line":94},[91,666,668],{"class":667},"s95oV","{\n",[91,670,671,675,678,682],{"class":93,"line":100},[91,672,674],{"class":673},"sDLfK","  \"displayName\"",[91,676,677],{"class":667},": ",[91,679,681],{"class":680},"sU2Wk","\"CA002 - All users - Block legacy authentication\"",[91,683,684],{"class":667},",\n",[91,686,687,690,692,695],{"class":93,"line":106},[91,688,689],{"class":673},"  \"state\"",[91,691,677],{"class":667},[91,693,694],{"class":680},"\"enabledForReportingButNotEnforced\"",[91,696,684],{"class":667},[91,698,699,702],{"class":93,"line":112},[91,700,701],{"class":673},"  \"conditions\"",[91,703,704],{"class":667},": {\n",[91,706,708,711],{"class":93,"line":707},5,[91,709,710],{"class":673},"    \"users\"",[91,712,704],{"class":667},[91,714,716,719,722,725],{"class":93,"line":715},6,[91,717,718],{"class":673},"      \"includeUsers\"",[91,720,721],{"class":667},": [",[91,723,724],{"class":680},"\"All\"",[91,726,727],{"class":667},"],\n",[91,729,731,734,736,739],{"class":93,"line":730},7,[91,732,733],{"class":673},"      \"excludeGroups\"",[91,735,721],{"class":667},[91,737,738],{"class":680},"\"\u003Cemergency-access-group-object-id>\"",[91,740,741],{"class":667},"]\n",[91,743,745],{"class":93,"line":744},8,[91,746,747],{"class":667},"    },\n",[91,749,751,754],{"class":93,"line":750},9,[91,752,753],{"class":673},"    \"applications\"",[91,755,704],{"class":667},[91,757,759,762,764,766],{"class":93,"line":758},10,[91,760,761],{"class":673},"      \"includeApplications\"",[91,763,721],{"class":667},[91,765,724],{"class":680},[91,767,741],{"class":667},[91,769,771],{"class":93,"line":770},11,[91,772,747],{"class":667},[91,774,776,779,781,784,786,789],{"class":93,"line":775},12,[91,777,778],{"class":673},"    \"clientAppTypes\"",[91,780,721],{"class":667},[91,782,783],{"class":680},"\"exchangeActiveSync\"",[91,785,620],{"class":667},[91,787,788],{"class":680},"\"other\"",[91,790,741],{"class":667},[91,792,794],{"class":93,"line":793},13,[91,795,796],{"class":667},"  },\n",[91,798,800,803],{"class":93,"line":799},14,[91,801,802],{"class":673},"  \"grantControls\"",[91,804,704],{"class":667},[91,806,808,811,813,816],{"class":93,"line":807},15,[91,809,810],{"class":673},"    \"operator\"",[91,812,677],{"class":667},[91,814,815],{"class":680},"\"OR\"",[91,817,684],{"class":667},[91,819,821,824,826,829],{"class":93,"line":820},16,[91,822,823],{"class":673},"    \"builtInControls\"",[91,825,721],{"class":667},[91,827,828],{"class":680},"\"block\"",[91,830,741],{"class":667},[91,832,834],{"class":93,"line":833},17,[91,835,836],{"class":667},"  }\n",[91,838,840],{"class":93,"line":839},18,[91,841,842],{"class":667},"}\n",[11,844,845],{},"CA001 swaps the users block for built-in role template IDs and the grant for an authentication strength reference:",[82,847,849],{"className":658,"code":848,"language":660,"meta":87,"style":87},"{\n  \"displayName\": \"CA001 - Admins - Require phishing-resistant MFA\",\n  \"state\": \"enabledForReportingButNotEnforced\",\n  \"conditions\": {\n    \"users\": {\n      \"includeRoles\": [\n        \"62e90394-69f5-4237-9190-012177145e10\",\n        \"729827e3-9c14-49f7-bb1b-9608f156bbb8\",\n        \"966707d0-3269-4727-9be2-8c3a10f19b9d\"\n      ],\n      \"excludeGroups\": [\"\u003Cemergency-access-group-object-id>\"]\n    },\n    \"applications\": { \"includeApplications\": [\"All\"] },\n    \"clientAppTypes\": [\"all\"]\n  },\n  \"grantControls\": {\n    \"operator\": \"OR\",\n    \"builtInControls\": [],\n    \"authenticationStrength\": { \"id\": \"\u003Cphishing-resistant-strength-id>\" }\n  }\n}\n",[37,850,851,855,866,876,882,888,896,903,910,915,920,930,934,951,962,966,972,982,989,1008,1013],{"__ignoreMap":87},[91,852,853],{"class":93,"line":94},[91,854,668],{"class":667},[91,856,857,859,861,864],{"class":93,"line":100},[91,858,674],{"class":673},[91,860,677],{"class":667},[91,862,863],{"class":680},"\"CA001 - Admins - Require phishing-resistant MFA\"",[91,865,684],{"class":667},[91,867,868,870,872,874],{"class":93,"line":106},[91,869,689],{"class":673},[91,871,677],{"class":667},[91,873,694],{"class":680},[91,875,684],{"class":667},[91,877,878,880],{"class":93,"line":112},[91,879,701],{"class":673},[91,881,704],{"class":667},[91,883,884,886],{"class":93,"line":707},[91,885,710],{"class":673},[91,887,704],{"class":667},[91,889,890,893],{"class":93,"line":715},[91,891,892],{"class":673},"      \"includeRoles\"",[91,894,895],{"class":667},": [\n",[91,897,898,901],{"class":93,"line":730},[91,899,900],{"class":680},"        \"62e90394-69f5-4237-9190-012177145e10\"",[91,902,684],{"class":667},[91,904,905,908],{"class":93,"line":744},[91,906,907],{"class":680},"        \"729827e3-9c14-49f7-bb1b-9608f156bbb8\"",[91,909,684],{"class":667},[91,911,912],{"class":93,"line":750},[91,913,914],{"class":680},"        \"966707d0-3269-4727-9be2-8c3a10f19b9d\"\n",[91,916,917],{"class":93,"line":758},[91,918,919],{"class":667},"      ],\n",[91,921,922,924,926,928],{"class":93,"line":770},[91,923,733],{"class":673},[91,925,721],{"class":667},[91,927,738],{"class":680},[91,929,741],{"class":667},[91,931,932],{"class":93,"line":775},[91,933,747],{"class":667},[91,935,936,938,941,944,946,948],{"class":93,"line":793},[91,937,753],{"class":673},[91,939,940],{"class":667},": { ",[91,942,943],{"class":673},"\"includeApplications\"",[91,945,721],{"class":667},[91,947,724],{"class":680},[91,949,950],{"class":667},"] },\n",[91,952,953,955,957,960],{"class":93,"line":799},[91,954,778],{"class":673},[91,956,721],{"class":667},[91,958,959],{"class":680},"\"all\"",[91,961,741],{"class":667},[91,963,964],{"class":93,"line":807},[91,965,796],{"class":667},[91,967,968,970],{"class":93,"line":820},[91,969,802],{"class":673},[91,971,704],{"class":667},[91,973,974,976,978,980],{"class":93,"line":833},[91,975,810],{"class":673},[91,977,677],{"class":667},[91,979,815],{"class":680},[91,981,684],{"class":667},[91,983,984,986],{"class":93,"line":839},[91,985,823],{"class":673},[91,987,988],{"class":667},": [],\n",[91,990,992,995,997,1000,1002,1005],{"class":93,"line":991},19,[91,993,994],{"class":673},"    \"authenticationStrength\"",[91,996,940],{"class":667},[91,998,999],{"class":673},"\"id\"",[91,1001,677],{"class":667},[91,1003,1004],{"class":680},"\"\u003Cphishing-resistant-strength-id>\"",[91,1006,1007],{"class":667}," }\n",[91,1009,1011],{"class":93,"line":1010},20,[91,1012,836],{"class":667},[91,1014,1016],{"class":93,"line":1015},21,[91,1017,842],{"class":667},[11,1019,1020,1021,1024],{},"Those three role IDs are Global Administrator, Helpdesk Administrator, and Password Administrator; the script below carries all fourteen. Look up the strength ID rather than hard-coding it: ",[37,1022,1023],{},"Get-MgPolicyAuthenticationStrengthPolicy -Filter \"policyType eq 'builtIn'\""," lists the three built-in strengths.",[18,1026,1028],{"id":1027},"create-the-whole-set-in-report-only-with-powershell","Create the whole set in report-only with PowerShell",[11,1030,1031,1032,1034,1035,1037,1038,1041,1042,620,1045,620,1048,1051,1052,1055,1056,1059,1060,1063],{},"This script creates all seven policies with ",[37,1033,623],{}," set to ",[37,1036,646],{},". It resolves the built-in authentication strengths and the Windows Azure Service Management API service principal at run time, skips any policy whose name already exists, and supports ",[37,1039,1040],{},"-WhatIf",". It needs the Microsoft.Graph PowerShell SDK (",[37,1043,1044],{},"Microsoft.Graph.Authentication",[37,1046,1047],{},"Microsoft.Graph.Identity.SignIns",[37,1049,1050],{},"Microsoft.Graph.Applications",") and a Conditional Access Administrator or Security Administrator. The Graph create API requires ",[37,1053,1054],{},"Policy.Read.All"," plus ",[37,1057,1058],{},"Policy.ReadWrite.ConditionalAccess",", and Microsoft documents a known issue where it can ask for consent to more than that; ",[37,1061,1062],{},"Application.Read.All"," covers the service principal lookup.",[82,1065,1069],{"className":1066,"code":1067,"language":1068,"meta":87,"style":87},"language-powershell shiki shiki-themes github-dark","\u003C#\n.SYNOPSIS\n    Creates a baseline set of Entra ID Conditional Access policies in report-only mode.\n.DESCRIPTION\n    Resolves the built-in authentication strengths and the Windows Azure Service Management API\n    service principal, then creates seven Conditional Access policies (CA001-CA007) with state\n    enabledForReportingButNotEnforced. Every policy excludes the emergency access group. Policies\n    whose display name already exists are skipped, so the script is safe to rerun.\n.PARAMETER EmergencyAccessGroupId\n    Object ID of the security group that holds the emergency access (break-glass) accounts.\n.PARAMETER ExcludeDirectorySyncRole\n    Also exclude the Directory Synchronization Accounts role from the all-users policies. Use it\n    when Microsoft Entra Connect or Cloud Sync is in place.\n.EXAMPLE\n    .\\New-CaReportOnlyBaseline.ps1 -EmergencyAccessGroupId \"\u003Cgroup-object-id>\" -ExcludeDirectorySyncRole -WhatIf\n.NOTES\n    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n    Version : 1.0 (2026-08-05)\n    Requires: PowerShell 7+, Microsoft.Graph.Identity.SignIns, Microsoft.Graph.Applications,\n              Conditional Access Administrator or Security Administrator\n#>\n[CmdletBinding(SupportsShouldProcess = $true)]\nparam (\n    [Parameter(Mandatory = $true)]\n    [string]$EmergencyAccessGroupId,\n\n    [switch]$ExcludeDirectorySyncRole\n)\n\n$ErrorActionPreference = 'Stop'\nImport-Module Microsoft.Graph.Identity.SignIns\nImport-Module Microsoft.Graph.Applications\n\nConnect-MgGraph -Scopes 'Policy.Read.All', 'Policy.ReadWrite.ConditionalAccess', 'Application.Read.All' -NoWelcome\n\n$reportOnly = 'enabledForReportingButNotEnforced'\n\n# Built-in role template IDs for the 14 roles in Microsoft's admin MFA templates.\n$adminRoles = @(\n    '62e90394-69f5-4237-9190-012177145e10',\n    '9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3',\n    'c4e39bd9-1100-46d3-8c65-fb160da0071f',\n    'b0f54661-2d74-4c50-afa3-1ec803f12efe',\n    '158c047a-c907-4556-b7ef-446551a6b5f7',\n    'b1be1c3e-b65d-4f19-8427-f6fa0d97feb9',\n    '29232cdf-9323-42fd-ade2-1d097af3e4de',\n    '729827e3-9c14-49f7-bb1b-9608f156bbb8',\n    '966707d0-3269-4727-9be2-8c3a10f19b9d',\n    '7be44c8a-adaf-4e2a-84d6-ab2649e08a13',\n    'e8611ab8-c189-46e8-94e1-60213ab1f814',\n    '194ae4cb-b126-40b2-bd5b-6091b380977d',\n    'f28a1f50-f6e7-4571-818b-6a12f2af6b6c',\n    'fe930be7-5e62-47db-91af-98c3a49a38b1'\n)\n\n# Directory Synchronization Accounts role template ID.\n$syncRole = 'd29b2b05-8046-44ba-8758-1e26182fcf32'\n\n# Resolve the built-in authentication strengths instead of hard-coding their IDs.\n$strengths = Get-MgPolicyAuthenticationStrengthPolicy -Filter \"policyType eq 'builtIn'\" -All\n$mfaStrength = $strengths | Where-Object { $_.DisplayName -eq 'Multifactor authentication' } | Select-Object -First 1\n$phishStrength = $strengths | Where-Object { $_.DisplayName -like '*phishing*' } | Select-Object -First 1\nif (-not $mfaStrength -or -not $phishStrength) {\n    throw 'Could not resolve the built-in authentication strengths.'\n}\n\n$azureMgmt = Get-MgServicePrincipal -Filter \"displayName eq 'Windows Azure Service Management API'\" -Property 'appId' |\n    Select-Object -First 1\n\n# Scope shared by the all-users policies.\n$allUsers = @{\n    includeUsers  = @('All')\n    excludeGroups = @($EmergencyAccessGroupId)\n}\nif ($ExcludeDirectorySyncRole) {\n    $allUsers.excludeRoles = @($syncRole)\n}\n\n$policies = [System.Collections.Generic.List[hashtable]]::new()\n\n$policies.Add(@{\n    displayName   = 'CA001 - Admins - Require phishing-resistant MFA'\n    state         = $reportOnly\n    conditions    = @{\n        users          = @{ includeRoles = $adminRoles; excludeGroups = @($EmergencyAccessGroupId) }\n        applications   = @{ includeApplications = @('All') }\n        clientAppTypes = @('all')\n    }\n    grantControls = @{ operator = 'OR'; builtInControls = @(); authenticationStrength = @{ id = $phishStrength.Id } }\n})\n\n$policies.Add(@{\n    displayName   = 'CA002 - All users - Block legacy authentication'\n    state         = $reportOnly\n    conditions    = @{\n        users          = $allUsers\n        applications   = @{ includeApplications = @('All') }\n        clientAppTypes = @('exchangeActiveSync', 'other')\n    }\n    grantControls = @{ operator = 'OR'; builtInControls = @('block') }\n})\n\n$policies.Add(@{\n    displayName   = 'CA003 - All users - Require MFA strength'\n    state         = $reportOnly\n    conditions    = @{\n        users          = $allUsers\n        applications   = @{ includeApplications = @('All') }\n        clientAppTypes = @('all')\n    }\n    grantControls = @{ operator = 'OR'; builtInControls = @(); authenticationStrength = @{ id = $mfaStrength.Id } }\n})\n\nif ($azureMgmt) {\n    $policies.Add(@{\n        displayName   = 'CA004 - All users - Require MFA for Azure management'\n        state         = $reportOnly\n        conditions    = @{\n            users          = @{ includeUsers = @('All'); excludeGroups = @($EmergencyAccessGroupId) }\n            applications   = @{ includeApplications = @($azureMgmt.AppId) }\n            clientAppTypes = @('all')\n        }\n        grantControls = @{ operator = 'OR'; builtInControls = @('mfa') }\n    })\n} else {\n    Write-Warning 'Windows Azure Service Management API service principal not found; skipping CA004.'\n}\n\n$policies.Add(@{\n    displayName   = 'CA005 - All users - Secure security info registration'\n    state         = $reportOnly\n    conditions    = @{\n        users          = @{\n            includeUsers  = @('All')\n            excludeUsers  = @('GuestsOrExternalUsers')\n            excludeGroups = @($EmergencyAccessGroupId)\n        }\n        applications   = @{ includeUserActions = @('urn:user:registersecurityinfo') }\n        locations      = @{ includeLocations = @('All'); excludeLocations = @('AllTrusted') }\n        clientAppTypes = @('all')\n    }\n    grantControls = @{ operator = 'OR'; builtInControls = @(); authenticationStrength = @{ id = $mfaStrength.Id } }\n})\n\n$policies.Add(@{\n    displayName   = 'CA006 - All users - Windows compliant or hybrid joined'\n    state         = $reportOnly\n    conditions    = @{\n        users          = $allUsers\n        applications   = @{ includeApplications = @('All') }\n        platforms      = @{ includePlatforms = @('windows') }\n        clientAppTypes = @('all')\n    }\n    grantControls = @{ operator = 'OR'; builtInControls = @('compliantDevice', 'domainJoinedDevice') }\n})\n\n$policies.Add(@{\n    displayName     = 'CA007 - All users - MFA for medium and high sign-in risk'\n    state           = $reportOnly\n    conditions      = @{\n        users            = @{ includeUsers = @('All'); excludeGroups = @($EmergencyAccessGroupId) }\n        applications     = @{ includeApplications = @('All') }\n        signInRiskLevels = @('high', 'medium')\n        clientAppTypes   = @('all')\n    }\n    grantControls   = @{ operator = 'OR'; builtInControls = @(); authenticationStrength = @{ id = $mfaStrength.Id } }\n    sessionControls = @{\n        signInFrequency = @{\n            isEnabled          = $true\n            frequencyInterval  = 'everyTime'\n            authenticationType = 'primaryAndSecondaryAuthentication'\n        }\n    }\n})\n\n$existing = @(Get-MgIdentityConditionalAccessPolicy -All | ForEach-Object { $_.DisplayName })\n\nforeach ($policy in $policies) {\n    if ($existing -contains $policy.displayName) {\n        Write-Warning \"Skipping '$($policy.displayName)': a policy with that name already exists.\"\n        continue\n    }\n\n    if ($PSCmdlet.ShouldProcess($policy.displayName, 'Create Conditional Access policy in report-only mode')) {\n        $created = New-MgIdentityConditionalAccessPolicy -BodyParameter $policy\n        [PSCustomObject]@{\n            DisplayName = $created.DisplayName\n            State       = $created.State\n            Id          = $created.Id\n        }\n    }\n}\n","powershell",[37,1070,1071,1077,1085,1090,1097,1102,1107,1112,1117,1127,1132,1141,1146,1151,1158,1163,1170,1175,1180,1185,1190,1195,1220,1229,1249,1262,1269,1280,1286,1291,1302,1311,1319,1324,1355,1360,1372,1377,1383,1397,1405,1413,1421,1429,1437,1445,1453,1461,1469,1477,1485,1493,1501,1507,1512,1517,1523,1534,1539,1545,1569,1617,1655,1679,1688,1693,1698,1727,1739,1744,1750,1762,1779,1792,1797,1805,1818,1823,1828,1850,1855,1866,1877,1888,1900,1925,1949,1966,1972,2012,2018,2023,2032,2042,2051,2062,2072,2093,2114,2119,2147,2152,2157,2166,2176,2185,2196,2205,2226,2241,2246,2280,2285,2290,2298,2308,2319,2329,2341,2371,2390,2406,2412,2441,2447,2459,2468,2473,2478,2487,2497,2506,2517,2528,2544,2561,2573,2578,2601,2636,2651,2656,2689,2694,2699,2708,2718,2727,2738,2747,2768,2792,2807,2812,2845,2850,2855,2864,2875,2885,2897,2925,2947,2969,2985,2990,3024,3036,3048,3059,3070,3081,3086,3091,3096,3101,3133,3138,3153,3168,3191,3197,3202,3207,3228,3244,3260,3271,3282,3293,3298,3303],{"__ignoreMap":87},[91,1072,1073],{"class":93,"line":94},[91,1074,1076],{"class":1075},"sAwPA","\u003C#\n",[91,1078,1079,1081],{"class":93,"line":100},[91,1080,70],{"class":673},[91,1082,1084],{"class":1083},"snl16","SYNOPSIS\n",[91,1086,1087],{"class":93,"line":106},[91,1088,1089],{"class":1075},"    Creates a baseline set of Entra ID Conditional Access policies in report-only mode.\n",[91,1091,1092,1094],{"class":93,"line":112},[91,1093,70],{"class":673},[91,1095,1096],{"class":1083},"DESCRIPTION\n",[91,1098,1099],{"class":93,"line":707},[91,1100,1101],{"class":1075},"    Resolves the built-in authentication strengths and the Windows Azure Service Management API\n",[91,1103,1104],{"class":93,"line":715},[91,1105,1106],{"class":1075},"    service principal, then creates seven Conditional Access policies (CA001-CA007) with state\n",[91,1108,1109],{"class":93,"line":730},[91,1110,1111],{"class":1075},"    enabledForReportingButNotEnforced. Every policy excludes the emergency access group. Policies\n",[91,1113,1114],{"class":93,"line":744},[91,1115,1116],{"class":1075},"    whose display name already exists are skipped, so the script is safe to rerun.\n",[91,1118,1119,1121,1124],{"class":93,"line":750},[91,1120,70],{"class":673},[91,1122,1123],{"class":1083},"PARAMETER",[91,1125,1126],{"class":1083}," EmergencyAccessGroupId\n",[91,1128,1129],{"class":93,"line":758},[91,1130,1131],{"class":1075},"    Object ID of the security group that holds the emergency access (break-glass) accounts.\n",[91,1133,1134,1136,1138],{"class":93,"line":770},[91,1135,70],{"class":673},[91,1137,1123],{"class":1083},[91,1139,1140],{"class":1083}," ExcludeDirectorySyncRole\n",[91,1142,1143],{"class":93,"line":775},[91,1144,1145],{"class":1075},"    Also exclude the Directory Synchronization Accounts role from the all-users policies. Use it\n",[91,1147,1148],{"class":93,"line":793},[91,1149,1150],{"class":1075},"    when Microsoft Entra Connect or Cloud Sync is in place.\n",[91,1152,1153,1155],{"class":93,"line":799},[91,1154,70],{"class":673},[91,1156,1157],{"class":1083},"EXAMPLE\n",[91,1159,1160],{"class":93,"line":807},[91,1161,1162],{"class":1075},"    .\\New-CaReportOnlyBaseline.ps1 -EmergencyAccessGroupId \"\u003Cgroup-object-id>\" -ExcludeDirectorySyncRole -WhatIf\n",[91,1164,1165,1167],{"class":93,"line":820},[91,1166,70],{"class":673},[91,1168,1169],{"class":1083},"NOTES\n",[91,1171,1172],{"class":93,"line":833},[91,1173,1174],{"class":1075},"    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n",[91,1176,1177],{"class":93,"line":839},[91,1178,1179],{"class":1075},"    Version : 1.0 (2026-08-05)\n",[91,1181,1182],{"class":93,"line":991},[91,1183,1184],{"class":1075},"    Requires: PowerShell 7+, Microsoft.Graph.Identity.SignIns, Microsoft.Graph.Applications,\n",[91,1186,1187],{"class":93,"line":1010},[91,1188,1189],{"class":1075},"              Conditional Access Administrator or Security Administrator\n",[91,1191,1192],{"class":93,"line":1015},[91,1193,1194],{"class":1075},"#>\n",[91,1196,1198,1201,1204,1207,1211,1214,1217],{"class":93,"line":1197},22,[91,1199,1200],{"class":667},"[",[91,1202,1203],{"class":673},"CmdletBinding",[91,1205,1206],{"class":667},"(",[91,1208,1210],{"class":1209},"s9osk","SupportsShouldProcess",[91,1212,1213],{"class":1083}," =",[91,1215,1216],{"class":673}," $true",[91,1218,1219],{"class":667},")]\n",[91,1221,1223,1226],{"class":93,"line":1222},23,[91,1224,1225],{"class":1083},"param",[91,1227,1228],{"class":667}," (\n",[91,1230,1232,1235,1238,1240,1243,1245,1247],{"class":93,"line":1231},24,[91,1233,1234],{"class":667},"    [",[91,1236,1237],{"class":673},"Parameter",[91,1239,1206],{"class":667},[91,1241,1242],{"class":1209},"Mandatory",[91,1244,1213],{"class":1083},[91,1246,1216],{"class":673},[91,1248,1219],{"class":667},[91,1250,1252,1254,1257,1260],{"class":93,"line":1251},25,[91,1253,1234],{"class":667},[91,1255,1256],{"class":1083},"string",[91,1258,1259],{"class":667},"]$EmergencyAccessGroupId",[91,1261,684],{"class":1083},[91,1263,1265],{"class":93,"line":1264},26,[91,1266,1268],{"emptyLinePlaceholder":1267},true,"\n",[91,1270,1272,1274,1277],{"class":93,"line":1271},27,[91,1273,1234],{"class":667},[91,1275,1276],{"class":1083},"switch",[91,1278,1279],{"class":667},"]$ExcludeDirectorySyncRole\n",[91,1281,1283],{"class":93,"line":1282},28,[91,1284,1285],{"class":667},")\n",[91,1287,1289],{"class":93,"line":1288},29,[91,1290,1268],{"emptyLinePlaceholder":1267},[91,1292,1294,1297,1299],{"class":93,"line":1293},30,[91,1295,1296],{"class":673},"$ErrorActionPreference",[91,1298,1213],{"class":1083},[91,1300,1301],{"class":680}," 'Stop'\n",[91,1303,1305,1308],{"class":93,"line":1304},31,[91,1306,1307],{"class":673},"Import-Module",[91,1309,1310],{"class":667}," Microsoft.Graph.Identity.SignIns\n",[91,1312,1314,1316],{"class":93,"line":1313},32,[91,1315,1307],{"class":673},[91,1317,1318],{"class":667}," Microsoft.Graph.Applications\n",[91,1320,1322],{"class":93,"line":1321},33,[91,1323,1268],{"emptyLinePlaceholder":1267},[91,1325,1327,1330,1333,1336,1339,1342,1345,1347,1350,1352],{"class":93,"line":1326},34,[91,1328,1329],{"class":673},"Connect-MgGraph",[91,1331,1332],{"class":1083}," -",[91,1334,1335],{"class":667},"Scopes ",[91,1337,1338],{"class":680},"'Policy.Read.All'",[91,1340,1341],{"class":1083},",",[91,1343,1344],{"class":680}," 'Policy.ReadWrite.ConditionalAccess'",[91,1346,1341],{"class":1083},[91,1348,1349],{"class":680}," 'Application.Read.All'",[91,1351,1332],{"class":1083},[91,1353,1354],{"class":667},"NoWelcome\n",[91,1356,1358],{"class":93,"line":1357},35,[91,1359,1268],{"emptyLinePlaceholder":1267},[91,1361,1363,1366,1369],{"class":93,"line":1362},36,[91,1364,1365],{"class":667},"$reportOnly ",[91,1367,1368],{"class":1083},"=",[91,1370,1371],{"class":680}," 'enabledForReportingButNotEnforced'\n",[91,1373,1375],{"class":93,"line":1374},37,[91,1376,1268],{"emptyLinePlaceholder":1267},[91,1378,1380],{"class":93,"line":1379},38,[91,1381,1382],{"class":1075},"# Built-in role template IDs for the 14 roles in Microsoft's admin MFA templates.\n",[91,1384,1386,1389,1391,1394],{"class":93,"line":1385},39,[91,1387,1388],{"class":667},"$adminRoles ",[91,1390,1368],{"class":1083},[91,1392,1393],{"class":1083}," @",[91,1395,1396],{"class":667},"(\n",[91,1398,1400,1403],{"class":93,"line":1399},40,[91,1401,1402],{"class":680},"    '62e90394-69f5-4237-9190-012177145e10'",[91,1404,684],{"class":1083},[91,1406,1408,1411],{"class":93,"line":1407},41,[91,1409,1410],{"class":680},"    '9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3'",[91,1412,684],{"class":1083},[91,1414,1416,1419],{"class":93,"line":1415},42,[91,1417,1418],{"class":680},"    'c4e39bd9-1100-46d3-8c65-fb160da0071f'",[91,1420,684],{"class":1083},[91,1422,1424,1427],{"class":93,"line":1423},43,[91,1425,1426],{"class":680},"    'b0f54661-2d74-4c50-afa3-1ec803f12efe'",[91,1428,684],{"class":1083},[91,1430,1432,1435],{"class":93,"line":1431},44,[91,1433,1434],{"class":680},"    '158c047a-c907-4556-b7ef-446551a6b5f7'",[91,1436,684],{"class":1083},[91,1438,1440,1443],{"class":93,"line":1439},45,[91,1441,1442],{"class":680},"    'b1be1c3e-b65d-4f19-8427-f6fa0d97feb9'",[91,1444,684],{"class":1083},[91,1446,1448,1451],{"class":93,"line":1447},46,[91,1449,1450],{"class":680},"    '29232cdf-9323-42fd-ade2-1d097af3e4de'",[91,1452,684],{"class":1083},[91,1454,1456,1459],{"class":93,"line":1455},47,[91,1457,1458],{"class":680},"    '729827e3-9c14-49f7-bb1b-9608f156bbb8'",[91,1460,684],{"class":1083},[91,1462,1464,1467],{"class":93,"line":1463},48,[91,1465,1466],{"class":680},"    '966707d0-3269-4727-9be2-8c3a10f19b9d'",[91,1468,684],{"class":1083},[91,1470,1472,1475],{"class":93,"line":1471},49,[91,1473,1474],{"class":680},"    '7be44c8a-adaf-4e2a-84d6-ab2649e08a13'",[91,1476,684],{"class":1083},[91,1478,1480,1483],{"class":93,"line":1479},50,[91,1481,1482],{"class":680},"    'e8611ab8-c189-46e8-94e1-60213ab1f814'",[91,1484,684],{"class":1083},[91,1486,1488,1491],{"class":93,"line":1487},51,[91,1489,1490],{"class":680},"    '194ae4cb-b126-40b2-bd5b-6091b380977d'",[91,1492,684],{"class":1083},[91,1494,1496,1499],{"class":93,"line":1495},52,[91,1497,1498],{"class":680},"    'f28a1f50-f6e7-4571-818b-6a12f2af6b6c'",[91,1500,684],{"class":1083},[91,1502,1504],{"class":93,"line":1503},53,[91,1505,1506],{"class":680},"    'fe930be7-5e62-47db-91af-98c3a49a38b1'\n",[91,1508,1510],{"class":93,"line":1509},54,[91,1511,1285],{"class":667},[91,1513,1515],{"class":93,"line":1514},55,[91,1516,1268],{"emptyLinePlaceholder":1267},[91,1518,1520],{"class":93,"line":1519},56,[91,1521,1522],{"class":1075},"# Directory Synchronization Accounts role template ID.\n",[91,1524,1526,1529,1531],{"class":93,"line":1525},57,[91,1527,1528],{"class":667},"$syncRole ",[91,1530,1368],{"class":1083},[91,1532,1533],{"class":680}," 'd29b2b05-8046-44ba-8758-1e26182fcf32'\n",[91,1535,1537],{"class":93,"line":1536},58,[91,1538,1268],{"emptyLinePlaceholder":1267},[91,1540,1542],{"class":93,"line":1541},59,[91,1543,1544],{"class":1075},"# Resolve the built-in authentication strengths instead of hard-coding their IDs.\n",[91,1546,1548,1551,1553,1556,1558,1561,1564,1566],{"class":93,"line":1547},60,[91,1549,1550],{"class":667},"$strengths ",[91,1552,1368],{"class":1083},[91,1554,1555],{"class":673}," Get-MgPolicyAuthenticationStrengthPolicy",[91,1557,1332],{"class":1083},[91,1559,1560],{"class":667},"Filter ",[91,1562,1563],{"class":680},"\"policyType eq 'builtIn'\"",[91,1565,1332],{"class":1083},[91,1567,1568],{"class":667},"All\n",[91,1570,1572,1575,1577,1580,1583,1586,1589,1592,1595,1598,1601,1604,1606,1609,1611,1614],{"class":93,"line":1571},61,[91,1573,1574],{"class":667},"$mfaStrength ",[91,1576,1368],{"class":1083},[91,1578,1579],{"class":667}," $strengths ",[91,1581,1582],{"class":1083},"|",[91,1584,1585],{"class":673}," Where-Object",[91,1587,1588],{"class":667}," { ",[91,1590,1591],{"class":673},"$_",[91,1593,1594],{"class":667},".DisplayName ",[91,1596,1597],{"class":1083},"-eq",[91,1599,1600],{"class":680}," 'Multifactor authentication'",[91,1602,1603],{"class":667}," } ",[91,1605,1582],{"class":1083},[91,1607,1608],{"class":673}," Select-Object",[91,1610,1332],{"class":1083},[91,1612,1613],{"class":667},"First ",[91,1615,1616],{"class":673},"1\n",[91,1618,1620,1623,1625,1627,1629,1631,1633,1635,1637,1640,1643,1645,1647,1649,1651,1653],{"class":93,"line":1619},62,[91,1621,1622],{"class":667},"$phishStrength ",[91,1624,1368],{"class":1083},[91,1626,1579],{"class":667},[91,1628,1582],{"class":1083},[91,1630,1585],{"class":673},[91,1632,1588],{"class":667},[91,1634,1591],{"class":673},[91,1636,1594],{"class":667},[91,1638,1639],{"class":1083},"-like",[91,1641,1642],{"class":680}," '*phishing*'",[91,1644,1603],{"class":667},[91,1646,1582],{"class":1083},[91,1648,1608],{"class":673},[91,1650,1332],{"class":1083},[91,1652,1613],{"class":667},[91,1654,1616],{"class":673},[91,1656,1658,1661,1664,1667,1670,1673,1676],{"class":93,"line":1657},63,[91,1659,1660],{"class":1083},"if",[91,1662,1663],{"class":667}," (",[91,1665,1666],{"class":1083},"-not",[91,1668,1669],{"class":667}," $mfaStrength ",[91,1671,1672],{"class":1083},"-or",[91,1674,1675],{"class":1083}," -not",[91,1677,1678],{"class":667}," $phishStrength) {\n",[91,1680,1682,1685],{"class":93,"line":1681},64,[91,1683,1684],{"class":1083},"    throw",[91,1686,1687],{"class":680}," 'Could not resolve the built-in authentication strengths.'\n",[91,1689,1691],{"class":93,"line":1690},65,[91,1692,842],{"class":667},[91,1694,1696],{"class":93,"line":1695},66,[91,1697,1268],{"emptyLinePlaceholder":1267},[91,1699,1701,1704,1706,1709,1711,1713,1716,1718,1721,1724],{"class":93,"line":1700},67,[91,1702,1703],{"class":667},"$azureMgmt ",[91,1705,1368],{"class":1083},[91,1707,1708],{"class":673}," Get-MgServicePrincipal",[91,1710,1332],{"class":1083},[91,1712,1560],{"class":667},[91,1714,1715],{"class":680},"\"displayName eq 'Windows Azure Service Management API'\"",[91,1717,1332],{"class":1083},[91,1719,1720],{"class":667},"Property ",[91,1722,1723],{"class":680},"'appId'",[91,1725,1726],{"class":1083}," |\n",[91,1728,1730,1733,1735,1737],{"class":93,"line":1729},68,[91,1731,1732],{"class":673},"    Select-Object",[91,1734,1332],{"class":1083},[91,1736,1613],{"class":667},[91,1738,1616],{"class":673},[91,1740,1742],{"class":93,"line":1741},69,[91,1743,1268],{"emptyLinePlaceholder":1267},[91,1745,1747],{"class":93,"line":1746},70,[91,1748,1749],{"class":1075},"# Scope shared by the all-users policies.\n",[91,1751,1753,1756,1758,1760],{"class":93,"line":1752},71,[91,1754,1755],{"class":667},"$allUsers ",[91,1757,1368],{"class":1083},[91,1759,1393],{"class":1083},[91,1761,668],{"class":667},[91,1763,1765,1768,1770,1772,1774,1777],{"class":93,"line":1764},72,[91,1766,1767],{"class":667},"    includeUsers  ",[91,1769,1368],{"class":1083},[91,1771,1393],{"class":1083},[91,1773,1206],{"class":667},[91,1775,1776],{"class":680},"'All'",[91,1778,1285],{"class":667},[91,1780,1782,1785,1787,1789],{"class":93,"line":1781},73,[91,1783,1784],{"class":667},"    excludeGroups ",[91,1786,1368],{"class":1083},[91,1788,1393],{"class":1083},[91,1790,1791],{"class":667},"($EmergencyAccessGroupId)\n",[91,1793,1795],{"class":93,"line":1794},74,[91,1796,842],{"class":667},[91,1798,1800,1802],{"class":93,"line":1799},75,[91,1801,1660],{"class":1083},[91,1803,1804],{"class":667}," ($ExcludeDirectorySyncRole) {\n",[91,1806,1808,1811,1813,1815],{"class":93,"line":1807},76,[91,1809,1810],{"class":667},"    $allUsers.excludeRoles ",[91,1812,1368],{"class":1083},[91,1814,1393],{"class":1083},[91,1816,1817],{"class":667},"($syncRole)\n",[91,1819,1821],{"class":93,"line":1820},77,[91,1822,842],{"class":667},[91,1824,1826],{"class":93,"line":1825},78,[91,1827,1268],{"emptyLinePlaceholder":1267},[91,1829,1831,1834,1836,1839,1842,1844,1847],{"class":93,"line":1830},79,[91,1832,1833],{"class":667},"$policies ",[91,1835,1368],{"class":1083},[91,1837,1838],{"class":667}," [",[91,1840,1841],{"class":1083},"System.Collections.Generic.List",[91,1843,1200],{"class":667},[91,1845,1846],{"class":1083},"hashtable",[91,1848,1849],{"class":667},"]]::new()\n",[91,1851,1853],{"class":93,"line":1852},80,[91,1854,1268],{"emptyLinePlaceholder":1267},[91,1856,1858,1861,1864],{"class":93,"line":1857},81,[91,1859,1860],{"class":667},"$policies.Add(",[91,1862,1863],{"class":1083},"@",[91,1865,668],{"class":667},[91,1867,1869,1872,1874],{"class":93,"line":1868},82,[91,1870,1871],{"class":667},"    displayName   ",[91,1873,1368],{"class":1083},[91,1875,1876],{"class":680}," 'CA001 - Admins - Require phishing-resistant MFA'\n",[91,1878,1880,1883,1885],{"class":93,"line":1879},83,[91,1881,1882],{"class":667},"    state         ",[91,1884,1368],{"class":1083},[91,1886,1887],{"class":667}," $reportOnly\n",[91,1889,1891,1894,1896,1898],{"class":93,"line":1890},84,[91,1892,1893],{"class":667},"    conditions    ",[91,1895,1368],{"class":1083},[91,1897,1393],{"class":1083},[91,1899,668],{"class":667},[91,1901,1903,1906,1908,1910,1913,1915,1918,1920,1922],{"class":93,"line":1902},85,[91,1904,1905],{"class":667},"        users          ",[91,1907,1368],{"class":1083},[91,1909,1393],{"class":1083},[91,1911,1912],{"class":667},"{ includeRoles ",[91,1914,1368],{"class":1083},[91,1916,1917],{"class":667}," $adminRoles; excludeGroups ",[91,1919,1368],{"class":1083},[91,1921,1393],{"class":1083},[91,1923,1924],{"class":667},"($EmergencyAccessGroupId) }\n",[91,1926,1928,1931,1933,1935,1938,1940,1942,1944,1946],{"class":93,"line":1927},86,[91,1929,1930],{"class":667},"        applications   ",[91,1932,1368],{"class":1083},[91,1934,1393],{"class":1083},[91,1936,1937],{"class":667},"{ includeApplications ",[91,1939,1368],{"class":1083},[91,1941,1393],{"class":1083},[91,1943,1206],{"class":667},[91,1945,1776],{"class":680},[91,1947,1948],{"class":667},") }\n",[91,1950,1952,1955,1957,1959,1961,1964],{"class":93,"line":1951},87,[91,1953,1954],{"class":667},"        clientAppTypes ",[91,1956,1368],{"class":1083},[91,1958,1393],{"class":1083},[91,1960,1206],{"class":667},[91,1962,1963],{"class":680},"'all'",[91,1965,1285],{"class":667},[91,1967,1969],{"class":93,"line":1968},88,[91,1970,1971],{"class":667},"    }\n",[91,1973,1975,1978,1980,1982,1985,1987,1990,1993,1995,1997,2000,2002,2004,2007,2009],{"class":93,"line":1974},89,[91,1976,1977],{"class":667},"    grantControls ",[91,1979,1368],{"class":1083},[91,1981,1393],{"class":1083},[91,1983,1984],{"class":667},"{ operator ",[91,1986,1368],{"class":1083},[91,1988,1989],{"class":680}," 'OR'",[91,1991,1992],{"class":667},"; builtInControls ",[91,1994,1368],{"class":1083},[91,1996,1393],{"class":1083},[91,1998,1999],{"class":667},"(); authenticationStrength ",[91,2001,1368],{"class":1083},[91,2003,1393],{"class":1083},[91,2005,2006],{"class":667},"{ id ",[91,2008,1368],{"class":1083},[91,2010,2011],{"class":667}," $phishStrength.Id } }\n",[91,2013,2015],{"class":93,"line":2014},90,[91,2016,2017],{"class":667},"})\n",[91,2019,2021],{"class":93,"line":2020},91,[91,2022,1268],{"emptyLinePlaceholder":1267},[91,2024,2026,2028,2030],{"class":93,"line":2025},92,[91,2027,1860],{"class":667},[91,2029,1863],{"class":1083},[91,2031,668],{"class":667},[91,2033,2035,2037,2039],{"class":93,"line":2034},93,[91,2036,1871],{"class":667},[91,2038,1368],{"class":1083},[91,2040,2041],{"class":680}," 'CA002 - All users - Block legacy authentication'\n",[91,2043,2045,2047,2049],{"class":93,"line":2044},94,[91,2046,1882],{"class":667},[91,2048,1368],{"class":1083},[91,2050,1887],{"class":667},[91,2052,2054,2056,2058,2060],{"class":93,"line":2053},95,[91,2055,1893],{"class":667},[91,2057,1368],{"class":1083},[91,2059,1393],{"class":1083},[91,2061,668],{"class":667},[91,2063,2065,2067,2069],{"class":93,"line":2064},96,[91,2066,1905],{"class":667},[91,2068,1368],{"class":1083},[91,2070,2071],{"class":667}," $allUsers\n",[91,2073,2075,2077,2079,2081,2083,2085,2087,2089,2091],{"class":93,"line":2074},97,[91,2076,1930],{"class":667},[91,2078,1368],{"class":1083},[91,2080,1393],{"class":1083},[91,2082,1937],{"class":667},[91,2084,1368],{"class":1083},[91,2086,1393],{"class":1083},[91,2088,1206],{"class":667},[91,2090,1776],{"class":680},[91,2092,1948],{"class":667},[91,2094,2096,2098,2100,2102,2104,2107,2109,2112],{"class":93,"line":2095},98,[91,2097,1954],{"class":667},[91,2099,1368],{"class":1083},[91,2101,1393],{"class":1083},[91,2103,1206],{"class":667},[91,2105,2106],{"class":680},"'exchangeActiveSync'",[91,2108,1341],{"class":1083},[91,2110,2111],{"class":680}," 'other'",[91,2113,1285],{"class":667},[91,2115,2117],{"class":93,"line":2116},99,[91,2118,1971],{"class":667},[91,2120,2122,2124,2126,2128,2130,2132,2134,2136,2138,2140,2142,2145],{"class":93,"line":2121},100,[91,2123,1977],{"class":667},[91,2125,1368],{"class":1083},[91,2127,1393],{"class":1083},[91,2129,1984],{"class":667},[91,2131,1368],{"class":1083},[91,2133,1989],{"class":680},[91,2135,1992],{"class":667},[91,2137,1368],{"class":1083},[91,2139,1393],{"class":1083},[91,2141,1206],{"class":667},[91,2143,2144],{"class":680},"'block'",[91,2146,1948],{"class":667},[91,2148,2150],{"class":93,"line":2149},101,[91,2151,2017],{"class":667},[91,2153,2155],{"class":93,"line":2154},102,[91,2156,1268],{"emptyLinePlaceholder":1267},[91,2158,2160,2162,2164],{"class":93,"line":2159},103,[91,2161,1860],{"class":667},[91,2163,1863],{"class":1083},[91,2165,668],{"class":667},[91,2167,2169,2171,2173],{"class":93,"line":2168},104,[91,2170,1871],{"class":667},[91,2172,1368],{"class":1083},[91,2174,2175],{"class":680}," 'CA003 - All users - Require MFA strength'\n",[91,2177,2179,2181,2183],{"class":93,"line":2178},105,[91,2180,1882],{"class":667},[91,2182,1368],{"class":1083},[91,2184,1887],{"class":667},[91,2186,2188,2190,2192,2194],{"class":93,"line":2187},106,[91,2189,1893],{"class":667},[91,2191,1368],{"class":1083},[91,2193,1393],{"class":1083},[91,2195,668],{"class":667},[91,2197,2199,2201,2203],{"class":93,"line":2198},107,[91,2200,1905],{"class":667},[91,2202,1368],{"class":1083},[91,2204,2071],{"class":667},[91,2206,2208,2210,2212,2214,2216,2218,2220,2222,2224],{"class":93,"line":2207},108,[91,2209,1930],{"class":667},[91,2211,1368],{"class":1083},[91,2213,1393],{"class":1083},[91,2215,1937],{"class":667},[91,2217,1368],{"class":1083},[91,2219,1393],{"class":1083},[91,2221,1206],{"class":667},[91,2223,1776],{"class":680},[91,2225,1948],{"class":667},[91,2227,2229,2231,2233,2235,2237,2239],{"class":93,"line":2228},109,[91,2230,1954],{"class":667},[91,2232,1368],{"class":1083},[91,2234,1393],{"class":1083},[91,2236,1206],{"class":667},[91,2238,1963],{"class":680},[91,2240,1285],{"class":667},[91,2242,2244],{"class":93,"line":2243},110,[91,2245,1971],{"class":667},[91,2247,2249,2251,2253,2255,2257,2259,2261,2263,2265,2267,2269,2271,2273,2275,2277],{"class":93,"line":2248},111,[91,2250,1977],{"class":667},[91,2252,1368],{"class":1083},[91,2254,1393],{"class":1083},[91,2256,1984],{"class":667},[91,2258,1368],{"class":1083},[91,2260,1989],{"class":680},[91,2262,1992],{"class":667},[91,2264,1368],{"class":1083},[91,2266,1393],{"class":1083},[91,2268,1999],{"class":667},[91,2270,1368],{"class":1083},[91,2272,1393],{"class":1083},[91,2274,2006],{"class":667},[91,2276,1368],{"class":1083},[91,2278,2279],{"class":667}," $mfaStrength.Id } }\n",[91,2281,2283],{"class":93,"line":2282},112,[91,2284,2017],{"class":667},[91,2286,2288],{"class":93,"line":2287},113,[91,2289,1268],{"emptyLinePlaceholder":1267},[91,2291,2293,2295],{"class":93,"line":2292},114,[91,2294,1660],{"class":1083},[91,2296,2297],{"class":667}," ($azureMgmt) {\n",[91,2299,2301,2304,2306],{"class":93,"line":2300},115,[91,2302,2303],{"class":667},"    $policies.Add(",[91,2305,1863],{"class":1083},[91,2307,668],{"class":667},[91,2309,2311,2314,2316],{"class":93,"line":2310},116,[91,2312,2313],{"class":667},"        displayName   ",[91,2315,1368],{"class":1083},[91,2317,2318],{"class":680}," 'CA004 - All users - Require MFA for Azure management'\n",[91,2320,2322,2325,2327],{"class":93,"line":2321},117,[91,2323,2324],{"class":667},"        state         ",[91,2326,1368],{"class":1083},[91,2328,1887],{"class":667},[91,2330,2332,2335,2337,2339],{"class":93,"line":2331},118,[91,2333,2334],{"class":667},"        conditions    ",[91,2336,1368],{"class":1083},[91,2338,1393],{"class":1083},[91,2340,668],{"class":667},[91,2342,2344,2347,2349,2351,2354,2356,2358,2360,2362,2365,2367,2369],{"class":93,"line":2343},119,[91,2345,2346],{"class":667},"            users          ",[91,2348,1368],{"class":1083},[91,2350,1393],{"class":1083},[91,2352,2353],{"class":667},"{ includeUsers ",[91,2355,1368],{"class":1083},[91,2357,1393],{"class":1083},[91,2359,1206],{"class":667},[91,2361,1776],{"class":680},[91,2363,2364],{"class":667},"); excludeGroups ",[91,2366,1368],{"class":1083},[91,2368,1393],{"class":1083},[91,2370,1924],{"class":667},[91,2372,2374,2377,2379,2381,2383,2385,2387],{"class":93,"line":2373},120,[91,2375,2376],{"class":667},"            applications   ",[91,2378,1368],{"class":1083},[91,2380,1393],{"class":1083},[91,2382,1937],{"class":667},[91,2384,1368],{"class":1083},[91,2386,1393],{"class":1083},[91,2388,2389],{"class":667},"($azureMgmt.AppId) }\n",[91,2391,2393,2396,2398,2400,2402,2404],{"class":93,"line":2392},121,[91,2394,2395],{"class":667},"            clientAppTypes ",[91,2397,1368],{"class":1083},[91,2399,1393],{"class":1083},[91,2401,1206],{"class":667},[91,2403,1963],{"class":680},[91,2405,1285],{"class":667},[91,2407,2409],{"class":93,"line":2408},122,[91,2410,2411],{"class":667},"        }\n",[91,2413,2415,2418,2420,2422,2424,2426,2428,2430,2432,2434,2436,2439],{"class":93,"line":2414},123,[91,2416,2417],{"class":667},"        grantControls ",[91,2419,1368],{"class":1083},[91,2421,1393],{"class":1083},[91,2423,1984],{"class":667},[91,2425,1368],{"class":1083},[91,2427,1989],{"class":680},[91,2429,1992],{"class":667},[91,2431,1368],{"class":1083},[91,2433,1393],{"class":1083},[91,2435,1206],{"class":667},[91,2437,2438],{"class":680},"'mfa'",[91,2440,1948],{"class":667},[91,2442,2444],{"class":93,"line":2443},124,[91,2445,2446],{"class":667},"    })\n",[91,2448,2450,2453,2456],{"class":93,"line":2449},125,[91,2451,2452],{"class":667},"} ",[91,2454,2455],{"class":1083},"else",[91,2457,2458],{"class":667}," {\n",[91,2460,2462,2465],{"class":93,"line":2461},126,[91,2463,2464],{"class":673},"    Write-Warning",[91,2466,2467],{"class":680}," 'Windows Azure Service Management API service principal not found; skipping CA004.'\n",[91,2469,2471],{"class":93,"line":2470},127,[91,2472,842],{"class":667},[91,2474,2476],{"class":93,"line":2475},128,[91,2477,1268],{"emptyLinePlaceholder":1267},[91,2479,2481,2483,2485],{"class":93,"line":2480},129,[91,2482,1860],{"class":667},[91,2484,1863],{"class":1083},[91,2486,668],{"class":667},[91,2488,2490,2492,2494],{"class":93,"line":2489},130,[91,2491,1871],{"class":667},[91,2493,1368],{"class":1083},[91,2495,2496],{"class":680}," 'CA005 - All users - Secure security info registration'\n",[91,2498,2500,2502,2504],{"class":93,"line":2499},131,[91,2501,1882],{"class":667},[91,2503,1368],{"class":1083},[91,2505,1887],{"class":667},[91,2507,2509,2511,2513,2515],{"class":93,"line":2508},132,[91,2510,1893],{"class":667},[91,2512,1368],{"class":1083},[91,2514,1393],{"class":1083},[91,2516,668],{"class":667},[91,2518,2520,2522,2524,2526],{"class":93,"line":2519},133,[91,2521,1905],{"class":667},[91,2523,1368],{"class":1083},[91,2525,1393],{"class":1083},[91,2527,668],{"class":667},[91,2529,2531,2534,2536,2538,2540,2542],{"class":93,"line":2530},134,[91,2532,2533],{"class":667},"            includeUsers  ",[91,2535,1368],{"class":1083},[91,2537,1393],{"class":1083},[91,2539,1206],{"class":667},[91,2541,1776],{"class":680},[91,2543,1285],{"class":667},[91,2545,2547,2550,2552,2554,2556,2559],{"class":93,"line":2546},135,[91,2548,2549],{"class":667},"            excludeUsers  ",[91,2551,1368],{"class":1083},[91,2553,1393],{"class":1083},[91,2555,1206],{"class":667},[91,2557,2558],{"class":680},"'GuestsOrExternalUsers'",[91,2560,1285],{"class":667},[91,2562,2564,2567,2569,2571],{"class":93,"line":2563},136,[91,2565,2566],{"class":667},"            excludeGroups ",[91,2568,1368],{"class":1083},[91,2570,1393],{"class":1083},[91,2572,1791],{"class":667},[91,2574,2576],{"class":93,"line":2575},137,[91,2577,2411],{"class":667},[91,2579,2581,2583,2585,2587,2590,2592,2594,2596,2599],{"class":93,"line":2580},138,[91,2582,1930],{"class":667},[91,2584,1368],{"class":1083},[91,2586,1393],{"class":1083},[91,2588,2589],{"class":667},"{ includeUserActions ",[91,2591,1368],{"class":1083},[91,2593,1393],{"class":1083},[91,2595,1206],{"class":667},[91,2597,2598],{"class":680},"'urn:user:registersecurityinfo'",[91,2600,1948],{"class":667},[91,2602,2604,2607,2609,2611,2614,2616,2618,2620,2622,2625,2627,2629,2631,2634],{"class":93,"line":2603},139,[91,2605,2606],{"class":667},"        locations      ",[91,2608,1368],{"class":1083},[91,2610,1393],{"class":1083},[91,2612,2613],{"class":667},"{ includeLocations ",[91,2615,1368],{"class":1083},[91,2617,1393],{"class":1083},[91,2619,1206],{"class":667},[91,2621,1776],{"class":680},[91,2623,2624],{"class":667},"); excludeLocations ",[91,2626,1368],{"class":1083},[91,2628,1393],{"class":1083},[91,2630,1206],{"class":667},[91,2632,2633],{"class":680},"'AllTrusted'",[91,2635,1948],{"class":667},[91,2637,2639,2641,2643,2645,2647,2649],{"class":93,"line":2638},140,[91,2640,1954],{"class":667},[91,2642,1368],{"class":1083},[91,2644,1393],{"class":1083},[91,2646,1206],{"class":667},[91,2648,1963],{"class":680},[91,2650,1285],{"class":667},[91,2652,2654],{"class":93,"line":2653},141,[91,2655,1971],{"class":667},[91,2657,2659,2661,2663,2665,2667,2669,2671,2673,2675,2677,2679,2681,2683,2685,2687],{"class":93,"line":2658},142,[91,2660,1977],{"class":667},[91,2662,1368],{"class":1083},[91,2664,1393],{"class":1083},[91,2666,1984],{"class":667},[91,2668,1368],{"class":1083},[91,2670,1989],{"class":680},[91,2672,1992],{"class":667},[91,2674,1368],{"class":1083},[91,2676,1393],{"class":1083},[91,2678,1999],{"class":667},[91,2680,1368],{"class":1083},[91,2682,1393],{"class":1083},[91,2684,2006],{"class":667},[91,2686,1368],{"class":1083},[91,2688,2279],{"class":667},[91,2690,2692],{"class":93,"line":2691},143,[91,2693,2017],{"class":667},[91,2695,2697],{"class":93,"line":2696},144,[91,2698,1268],{"emptyLinePlaceholder":1267},[91,2700,2702,2704,2706],{"class":93,"line":2701},145,[91,2703,1860],{"class":667},[91,2705,1863],{"class":1083},[91,2707,668],{"class":667},[91,2709,2711,2713,2715],{"class":93,"line":2710},146,[91,2712,1871],{"class":667},[91,2714,1368],{"class":1083},[91,2716,2717],{"class":680}," 'CA006 - All users - Windows compliant or hybrid joined'\n",[91,2719,2721,2723,2725],{"class":93,"line":2720},147,[91,2722,1882],{"class":667},[91,2724,1368],{"class":1083},[91,2726,1887],{"class":667},[91,2728,2730,2732,2734,2736],{"class":93,"line":2729},148,[91,2731,1893],{"class":667},[91,2733,1368],{"class":1083},[91,2735,1393],{"class":1083},[91,2737,668],{"class":667},[91,2739,2741,2743,2745],{"class":93,"line":2740},149,[91,2742,1905],{"class":667},[91,2744,1368],{"class":1083},[91,2746,2071],{"class":667},[91,2748,2750,2752,2754,2756,2758,2760,2762,2764,2766],{"class":93,"line":2749},150,[91,2751,1930],{"class":667},[91,2753,1368],{"class":1083},[91,2755,1393],{"class":1083},[91,2757,1937],{"class":667},[91,2759,1368],{"class":1083},[91,2761,1393],{"class":1083},[91,2763,1206],{"class":667},[91,2765,1776],{"class":680},[91,2767,1948],{"class":667},[91,2769,2771,2774,2776,2778,2781,2783,2785,2787,2790],{"class":93,"line":2770},151,[91,2772,2773],{"class":667},"        platforms      ",[91,2775,1368],{"class":1083},[91,2777,1393],{"class":1083},[91,2779,2780],{"class":667},"{ includePlatforms ",[91,2782,1368],{"class":1083},[91,2784,1393],{"class":1083},[91,2786,1206],{"class":667},[91,2788,2789],{"class":680},"'windows'",[91,2791,1948],{"class":667},[91,2793,2795,2797,2799,2801,2803,2805],{"class":93,"line":2794},152,[91,2796,1954],{"class":667},[91,2798,1368],{"class":1083},[91,2800,1393],{"class":1083},[91,2802,1206],{"class":667},[91,2804,1963],{"class":680},[91,2806,1285],{"class":667},[91,2808,2810],{"class":93,"line":2809},153,[91,2811,1971],{"class":667},[91,2813,2815,2817,2819,2821,2823,2825,2827,2829,2831,2833,2835,2838,2840,2843],{"class":93,"line":2814},154,[91,2816,1977],{"class":667},[91,2818,1368],{"class":1083},[91,2820,1393],{"class":1083},[91,2822,1984],{"class":667},[91,2824,1368],{"class":1083},[91,2826,1989],{"class":680},[91,2828,1992],{"class":667},[91,2830,1368],{"class":1083},[91,2832,1393],{"class":1083},[91,2834,1206],{"class":667},[91,2836,2837],{"class":680},"'compliantDevice'",[91,2839,1341],{"class":1083},[91,2841,2842],{"class":680}," 'domainJoinedDevice'",[91,2844,1948],{"class":667},[91,2846,2848],{"class":93,"line":2847},155,[91,2849,2017],{"class":667},[91,2851,2853],{"class":93,"line":2852},156,[91,2854,1268],{"emptyLinePlaceholder":1267},[91,2856,2858,2860,2862],{"class":93,"line":2857},157,[91,2859,1860],{"class":667},[91,2861,1863],{"class":1083},[91,2863,668],{"class":667},[91,2865,2867,2870,2872],{"class":93,"line":2866},158,[91,2868,2869],{"class":667},"    displayName     ",[91,2871,1368],{"class":1083},[91,2873,2874],{"class":680}," 'CA007 - All users - MFA for medium and high sign-in risk'\n",[91,2876,2878,2881,2883],{"class":93,"line":2877},159,[91,2879,2880],{"class":667},"    state           ",[91,2882,1368],{"class":1083},[91,2884,1887],{"class":667},[91,2886,2888,2891,2893,2895],{"class":93,"line":2887},160,[91,2889,2890],{"class":667},"    conditions      ",[91,2892,1368],{"class":1083},[91,2894,1393],{"class":1083},[91,2896,668],{"class":667},[91,2898,2900,2903,2905,2907,2909,2911,2913,2915,2917,2919,2921,2923],{"class":93,"line":2899},161,[91,2901,2902],{"class":667},"        users            ",[91,2904,1368],{"class":1083},[91,2906,1393],{"class":1083},[91,2908,2353],{"class":667},[91,2910,1368],{"class":1083},[91,2912,1393],{"class":1083},[91,2914,1206],{"class":667},[91,2916,1776],{"class":680},[91,2918,2364],{"class":667},[91,2920,1368],{"class":1083},[91,2922,1393],{"class":1083},[91,2924,1924],{"class":667},[91,2926,2928,2931,2933,2935,2937,2939,2941,2943,2945],{"class":93,"line":2927},162,[91,2929,2930],{"class":667},"        applications     ",[91,2932,1368],{"class":1083},[91,2934,1393],{"class":1083},[91,2936,1937],{"class":667},[91,2938,1368],{"class":1083},[91,2940,1393],{"class":1083},[91,2942,1206],{"class":667},[91,2944,1776],{"class":680},[91,2946,1948],{"class":667},[91,2948,2950,2953,2955,2957,2959,2962,2964,2967],{"class":93,"line":2949},163,[91,2951,2952],{"class":667},"        signInRiskLevels ",[91,2954,1368],{"class":1083},[91,2956,1393],{"class":1083},[91,2958,1206],{"class":667},[91,2960,2961],{"class":680},"'high'",[91,2963,1341],{"class":1083},[91,2965,2966],{"class":680}," 'medium'",[91,2968,1285],{"class":667},[91,2970,2972,2975,2977,2979,2981,2983],{"class":93,"line":2971},164,[91,2973,2974],{"class":667},"        clientAppTypes   ",[91,2976,1368],{"class":1083},[91,2978,1393],{"class":1083},[91,2980,1206],{"class":667},[91,2982,1963],{"class":680},[91,2984,1285],{"class":667},[91,2986,2988],{"class":93,"line":2987},165,[91,2989,1971],{"class":667},[91,2991,2993,2996,2998,3000,3002,3004,3006,3008,3010,3012,3014,3016,3018,3020,3022],{"class":93,"line":2992},166,[91,2994,2995],{"class":667},"    grantControls   ",[91,2997,1368],{"class":1083},[91,2999,1393],{"class":1083},[91,3001,1984],{"class":667},[91,3003,1368],{"class":1083},[91,3005,1989],{"class":680},[91,3007,1992],{"class":667},[91,3009,1368],{"class":1083},[91,3011,1393],{"class":1083},[91,3013,1999],{"class":667},[91,3015,1368],{"class":1083},[91,3017,1393],{"class":1083},[91,3019,2006],{"class":667},[91,3021,1368],{"class":1083},[91,3023,2279],{"class":667},[91,3025,3027,3030,3032,3034],{"class":93,"line":3026},167,[91,3028,3029],{"class":667},"    sessionControls ",[91,3031,1368],{"class":1083},[91,3033,1393],{"class":1083},[91,3035,668],{"class":667},[91,3037,3039,3042,3044,3046],{"class":93,"line":3038},168,[91,3040,3041],{"class":667},"        signInFrequency ",[91,3043,1368],{"class":1083},[91,3045,1393],{"class":1083},[91,3047,668],{"class":667},[91,3049,3051,3054,3056],{"class":93,"line":3050},169,[91,3052,3053],{"class":667},"            isEnabled          ",[91,3055,1368],{"class":1083},[91,3057,3058],{"class":673}," $true\n",[91,3060,3062,3065,3067],{"class":93,"line":3061},170,[91,3063,3064],{"class":667},"            frequencyInterval  ",[91,3066,1368],{"class":1083},[91,3068,3069],{"class":680}," 'everyTime'\n",[91,3071,3073,3076,3078],{"class":93,"line":3072},171,[91,3074,3075],{"class":667},"            authenticationType ",[91,3077,1368],{"class":1083},[91,3079,3080],{"class":680}," 'primaryAndSecondaryAuthentication'\n",[91,3082,3084],{"class":93,"line":3083},172,[91,3085,2411],{"class":667},[91,3087,3089],{"class":93,"line":3088},173,[91,3090,1971],{"class":667},[91,3092,3094],{"class":93,"line":3093},174,[91,3095,2017],{"class":667},[91,3097,3099],{"class":93,"line":3098},175,[91,3100,1268],{"emptyLinePlaceholder":1267},[91,3102,3104,3107,3109,3111,3113,3116,3118,3121,3123,3126,3128,3130],{"class":93,"line":3103},176,[91,3105,3106],{"class":667},"$existing ",[91,3108,1368],{"class":1083},[91,3110,1393],{"class":1083},[91,3112,1206],{"class":667},[91,3114,3115],{"class":673},"Get-MgIdentityConditionalAccessPolicy",[91,3117,1332],{"class":1083},[91,3119,3120],{"class":667},"All ",[91,3122,1582],{"class":1083},[91,3124,3125],{"class":673}," ForEach-Object",[91,3127,1588],{"class":667},[91,3129,1591],{"class":673},[91,3131,3132],{"class":667},".DisplayName })\n",[91,3134,3136],{"class":93,"line":3135},177,[91,3137,1268],{"emptyLinePlaceholder":1267},[91,3139,3141,3144,3147,3150],{"class":93,"line":3140},178,[91,3142,3143],{"class":1083},"foreach",[91,3145,3146],{"class":667}," ($policy ",[91,3148,3149],{"class":1083},"in",[91,3151,3152],{"class":667}," $policies) {\n",[91,3154,3156,3159,3162,3165],{"class":93,"line":3155},179,[91,3157,3158],{"class":1083},"    if",[91,3160,3161],{"class":667}," ($existing ",[91,3163,3164],{"class":1083},"-contains",[91,3166,3167],{"class":667}," $policy.displayName) {\n",[91,3169,3171,3174,3177,3180,3182,3185,3188],{"class":93,"line":3170},180,[91,3172,3173],{"class":673},"        Write-Warning",[91,3175,3176],{"class":680}," \"Skipping '",[91,3178,3179],{"class":1083},"$",[91,3181,1206],{"class":680},[91,3183,3184],{"class":667},"$policy.displayName",[91,3186,3187],{"class":680},")",[91,3189,3190],{"class":680},"': a policy with that name already exists.\"\n",[91,3192,3194],{"class":93,"line":3193},181,[91,3195,3196],{"class":1083},"        continue\n",[91,3198,3200],{"class":93,"line":3199},182,[91,3201,1971],{"class":667},[91,3203,3205],{"class":93,"line":3204},183,[91,3206,1268],{"emptyLinePlaceholder":1267},[91,3208,3210,3212,3214,3217,3220,3222,3225],{"class":93,"line":3209},184,[91,3211,3158],{"class":1083},[91,3213,1663],{"class":667},[91,3215,3216],{"class":673},"$PSCmdlet",[91,3218,3219],{"class":667},".ShouldProcess($policy.displayName",[91,3221,1341],{"class":1083},[91,3223,3224],{"class":680}," 'Create Conditional Access policy in report-only mode'",[91,3226,3227],{"class":667},")) {\n",[91,3229,3231,3234,3236,3239,3241],{"class":93,"line":3230},185,[91,3232,3233],{"class":667},"        $created ",[91,3235,1368],{"class":1083},[91,3237,3238],{"class":673}," New-MgIdentityConditionalAccessPolicy",[91,3240,1332],{"class":1083},[91,3242,3243],{"class":667},"BodyParameter $policy\n",[91,3245,3247,3250,3253,3256,3258],{"class":93,"line":3246},186,[91,3248,3249],{"class":667},"        [",[91,3251,3252],{"class":1083},"PSCustomObject",[91,3254,3255],{"class":667},"]",[91,3257,1863],{"class":1083},[91,3259,668],{"class":667},[91,3261,3263,3266,3268],{"class":93,"line":3262},187,[91,3264,3265],{"class":667},"            DisplayName ",[91,3267,1368],{"class":1083},[91,3269,3270],{"class":667}," $created.DisplayName\n",[91,3272,3274,3277,3279],{"class":93,"line":3273},188,[91,3275,3276],{"class":667},"            State       ",[91,3278,1368],{"class":1083},[91,3280,3281],{"class":667}," $created.State\n",[91,3283,3285,3288,3290],{"class":93,"line":3284},189,[91,3286,3287],{"class":667},"            Id          ",[91,3289,1368],{"class":1083},[91,3291,3292],{"class":667}," $created.Id\n",[91,3294,3296],{"class":93,"line":3295},190,[91,3297,2411],{"class":667},[91,3299,3301],{"class":93,"line":3300},191,[91,3302,1971],{"class":667},[91,3304,3306],{"class":93,"line":3305},192,[91,3307,842],{"class":667},[11,3309,3310,3311,3313],{},"Run it with ",[37,3312,1040],{}," first, then for real:",[82,3315,3320],{"className":3316,"code":3318,"language":3319,"meta":87},[3317],"language-text","DisplayName                                              State                             Id\n-----------                                              -----                             --\nCA001 - Admins - Require phishing-resistant MFA          enabledForReportingButNotEnforced 00000000-0000-0000-0000-000000000101\nCA002 - All users - Block legacy authentication          enabledForReportingButNotEnforced 00000000-0000-0000-0000-000000000102\nCA003 - All users - Require MFA strength                 enabledForReportingButNotEnforced 00000000-0000-0000-0000-000000000103\n...\n","text",[37,3321,3318],{"__ignoreMap":87},[18,3323,3325],{"id":3324},"read-report-only-results-before-you-flip-anything","Read report-only results before you flip anything",[11,3327,3328,3329,3331,3332,620,3335,3338,3339,3342,3343,3346],{},"Report-only means Entra evaluates the policy at every sign-in and logs what it would have done, without prompting or blocking. Each policy lands in one of four report-only results in the sign-in log's ",[32,3330,204],{}," tab: ",[32,3333,3334],{},"Success",[32,3336,3337],{},"Failure"," (a block, or a device that failed a compliance check), ",[32,3340,3341],{},"User action required"," (the user would have been prompted, for MFA for example), and ",[32,3344,3345],{},"Not applied",". \"User action required\" is the category people skip, and it's the one that turns into Monday-morning tickets: every sign-in there would have been an MFA prompt someone may not be registered for.",[11,3348,3349,3350,3353],{},"Report-only has limits. Microsoft's report-only article lists items in the ",[32,3351,3352],{},"User actions"," scope as the exception to what it can evaluate, so don't rely on report-only data alone for CA005; confirm it with a pilot group.",[11,3355,3356],{},"My staged sequence: report-only for at least a full business cycle including whatever shift pattern the affected users work, then review near-misses (users who would have failed, not just users who did), fix the gaps, and enforce for a pilot group before the full population. Three tools help:",[26,3358,3359,3365,3371],{},[29,3360,3361,3364],{},[32,3362,3363],{},"Policy impact"," on each policy's page shows potential impact on interactive sign-ins over 24 hours, 7 days, or a month. It needs at least Security Reader.",[29,3366,3367,3370],{},[32,3368,3369],{},"Conditional Access insights and reporting workbook"," (Entra ID > Conditional Access > Insights and reporting) shows report-only and enforced results side by side for up to 90 days. It needs Entra ID P1, sign-in logs streaming to a Log Analytics workspace, Security Reader, and permissions on that workspace.",[29,3372,3373,3376,3377,3380,3381,66,3383,3386,3387,620,3390,630,3393,3396,3397,3400],{},[32,3374,3375],{},"Log Analytics directly."," ",[37,3378,3379],{},"SigninLogs.ConditionalAccessPolicies"," is a dynamic array with each policy's ",[37,3382,619],{},[37,3384,3385],{},"result",", using values like ",[37,3388,3389],{},"reportOnlySuccess",[37,3391,3392],{},"reportOnlyFailure",[37,3394,3395],{},"reportOnlyNotApplied",". I also include ",[37,3398,3399],{},"reportOnlyInterrupted",", which is in Graph's result enum; filtering on it costs nothing.",[82,3402,3404],{"className":84,"code":3403,"language":86,"meta":87,"style":87},"\u002F\u002F Sign-ins that a report-only CA policy would have blocked or challenged, last 7 days\nSigninLogs\n| where TimeGenerated > ago(7d)\n| mv-expand Policy = ConditionalAccessPolicies\n| extend PolicyName = tostring(Policy.displayName), PolicyResult = tostring(Policy.result)\n| where PolicyName startswith \"CA0\"\n| where PolicyResult in (\"reportOnlyFailure\", \"reportOnlyInterrupted\")\n| summarize SignIns = count(), Users = dcount(UserPrincipalName), Apps = make_set(AppDisplayName, 10) by PolicyName, PolicyResult\n| order by SignIns desc\n",[37,3405,3406,3411,3415,3420,3425,3430,3435,3440,3445],{"__ignoreMap":87},[91,3407,3408],{"class":93,"line":94},[91,3409,3410],{},"\u002F\u002F Sign-ins that a report-only CA policy would have blocked or challenged, last 7 days\n",[91,3412,3413],{"class":93,"line":100},[91,3414,103],{},[91,3416,3417],{"class":93,"line":106},[91,3418,3419],{},"| where TimeGenerated > ago(7d)\n",[91,3421,3422],{"class":93,"line":112},[91,3423,3424],{},"| mv-expand Policy = ConditionalAccessPolicies\n",[91,3426,3427],{"class":93,"line":707},[91,3428,3429],{},"| extend PolicyName = tostring(Policy.displayName), PolicyResult = tostring(Policy.result)\n",[91,3431,3432],{"class":93,"line":715},[91,3433,3434],{},"| where PolicyName startswith \"CA0\"\n",[91,3436,3437],{"class":93,"line":730},[91,3438,3439],{},"| where PolicyResult in (\"reportOnlyFailure\", \"reportOnlyInterrupted\")\n",[91,3441,3442],{"class":93,"line":744},[91,3443,3444],{},"| summarize SignIns = count(), Users = dcount(UserPrincipalName), Apps = make_set(AppDisplayName, 10) by PolicyName, PolicyResult\n",[91,3446,3447],{"class":93,"line":750},[91,3448,3449],{},"| order by SignIns desc\n",[11,3451,3452,3453,3456,3457,3460],{},"Swap the ",[37,3454,3455],{},"summarize"," for ",[37,3458,3459],{},"project TimeGenerated, UserPrincipalName, AppDisplayName, ClientAppUsed, tostring(DeviceDetail.operatingSystem)"," to get the list of people to contact before you enforce.",[18,3462,3464],{"id":3463},"give-the-help-desk-a-way-to-see-what-the-user-sees","Give the help desk a way to see what the user sees",[11,3466,3467,3468,3471],{},"A technician troubleshooting \"I can't get into my email\" has almost no chance of diagnosing a Conditional Access block without the sign-in log's ",[32,3469,3470],{},"Conditional Access"," tab. The common shortcut is to hand tier 1 Reports Reader and point them at the What If tool. That isn't enough, and the permissions reference shows why:",[136,3473,3474,3487],{},[139,3475,3476],{},[142,3477,3478,3481,3484],{},[145,3479,3480],{},"Role",[145,3482,3483],{},"Reads sign-in logs",[145,3485,3486],{},"Reads Conditional Access policies",[152,3488,3489,3500,3510,3520],{},[142,3490,3491,3494,3497],{},[157,3492,3493],{},"Reports Reader",[157,3495,3496],{},"Yes",[157,3498,3499],{},"No",[142,3501,3502,3505,3507],{},[157,3503,3504],{},"Security Reader",[157,3506,3496],{},[157,3508,3509],{},"Yes (standard properties)",[142,3511,3512,3515,3517],{},[157,3513,3514],{},"Global Reader",[157,3516,3496],{},[157,3518,3519],{},"Yes (all properties), but it's flagged as a privileged role",[142,3521,3522,3524,3526],{},[157,3523,210],{},[157,3525,3499],{},[157,3527,3499],{},[11,3529,3530,3531,3534,3535,3538,3539,3541],{},"Reports Reader can open the sign-in logs, which is why Microsoft's troubleshooting steps start with it. But Graph documents that the applied Conditional Access policies on a sign-in are only returned to roles that can read Conditional Access data (Global Reader, Security Administrator, Security Reader, Conditional Access Administrator); without one, that property is simply left out. The What If page doesn't name a required role, but it evaluates your policy set through the ",[37,3532,3533],{},"conditionalAccess\u002Fevaluate"," API, which needs ",[37,3536,3537],{},"Policy.Read.ConditionalAccess",", so give tier 1 a role that can read policies. ",[32,3540,3504],{}," is the least-privileged built-in role that covers both halves. It also unlocks Policy impact and, with access to the Log Analytics workspace, the workbook.",[11,3543,3544,3545,3548,3549,3552,3553,3556,3557,3560,3561,3564,3565,3568,3569,3572],{},"Teach the error codes Microsoft lists for Conditional Access: ",[37,3546,3547],{},"53000"," DeviceNotCompliant, ",[37,3550,3551],{},"53001"," DeviceNotDomainJoined, ",[37,3554,3555],{},"53002"," ApplicationUsedIsNotAnApprovedApp, ",[37,3558,3559],{},"53003"," BlockedByConditionalAccess, ",[37,3562,3563],{},"53004"," ProofUpBlockedDueToRisk. The user sees them prefixed as ",[37,3566,3567],{},"AADSTS53003"," and so on, and ",[32,3570,3571],{},"More details"," on the error page gives the correlation ID to search for.",[11,3574,3575,3576,3578,3579,66,3582,3584,3585,3588],{},"For techs who'd rather not click through the portal, this script lists one user's recent sign-ins that a policy blocked, or that a report-only policy would have blocked. It uses only ",[37,3577,1044],{},", needs delegated ",[37,3580,3581],{},"AuditLog.Read.All",[37,3583,1054],{}," (an admin consents once), and a Security Reader role. It sends the ",[37,3586,3587],{},"Prefer: include-unknown-enum-members"," header, because without it Graph doesn't return the report-only result values.",[82,3590,3592],{"className":1066,"code":3591,"language":1068,"meta":87,"style":87},"\u003C#\n.SYNOPSIS\n    Lists a user's recent sign-ins that Conditional Access blocked or that a report-only policy would have blocked.\n.DESCRIPTION\n    Queries the Microsoft Graph sign-in logs for one user over a recent window and returns one row per\n    failing Conditional Access policy result: time, app, error code, failure reason, device OS,\n    compliance flag, policy, result, and correlation ID. Sends Prefer: include-unknown-enum-members so\n    report-only results (reportOnlyFailure, reportOnlyInterrupted) are returned.\n.PARAMETER UserPrincipalName\n    UPN of the user who reported the problem.\n.PARAMETER Hours\n    How many hours back to look. Default 24.\n.EXAMPLE\n    .\\Get-CaSignInFailure.ps1 -UserPrincipalName \"user@example.com\" -Hours 8\n.NOTES\n    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n    Version : 1.0 (2026-08-05)\n    Requires: PowerShell 7+, Microsoft.Graph.Authentication, AuditLog.Read.All and Policy.Read.All,\n              Security Reader (or another role that reads sign-in logs and Conditional Access data)\n#>\n[CmdletBinding()]\nparam (\n    [Parameter(Mandatory = $true)]\n    [string]$UserPrincipalName,\n\n    [ValidateRange(1, 720)]\n    [int]$Hours = 24\n)\n\n$ErrorActionPreference = 'Stop'\nImport-Module Microsoft.Graph.Authentication\nConnect-MgGraph -Scopes 'AuditLog.Read.All', 'Policy.Read.All' -NoWelcome\n\n$since = (Get-Date).ToUniversalTime().AddHours(-$Hours).ToString('yyyy-MM-ddTHH:mm:ssZ')\n$upn = $UserPrincipalName.ToLower().Replace(\"'\", \"''\")\n$filter = \"userPrincipalName eq '$upn' and createdDateTime ge $since\"\n$uri = \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002FauditLogs\u002FsignIns?`$filter=$([uri]::EscapeDataString($filter))&`$top=100\"\n$headers = @{ Prefer = 'include-unknown-enum-members' }\n$interesting = @('failure', 'reportOnlyFailure', 'reportOnlyInterrupted')\n\nwhile ($uri) {\n    $page = Invoke-MgGraphRequest -Method GET -Uri $uri -Headers $headers\n    foreach ($signIn in $page['value']) {\n        foreach ($policy in $signIn['appliedConditionalAccessPolicies']) {\n            if ($interesting -contains $policy['result']) {\n                [PSCustomObject]@{\n                    Time          = $signIn['createdDateTime']\n                    App           = $signIn['appDisplayName']\n                    ErrorCode     = $signIn['status']['errorCode']\n                    FailureReason = $signIn['status']['failureReason']\n                    OS            = $signIn['deviceDetail']['operatingSystem']\n                    IsCompliant   = $signIn['deviceDetail']['isCompliant']\n                    Policy        = $policy['displayName']\n                    Result        = $policy['result']\n                    CorrelationId = $signIn['correlationId']\n                }\n            }\n        }\n    }\n    $uri = $page['@odata.nextLink']\n}\n",[37,3593,3594,3598,3604,3609,3615,3620,3625,3630,3635,3644,3649,3658,3663,3669,3674,3680,3684,3688,3693,3698,3702,3711,3717,3733,3744,3748,3767,3782,3786,3790,3798,3805,3825,3829,3855,3875,3897,3938,3957,3983,3987,3995,4020,4039,4056,4074,4087,4101,4115,4135,4153,4172,4190,4204,4217,4231,4236,4241,4245,4249,4263],{"__ignoreMap":87},[91,3595,3596],{"class":93,"line":94},[91,3597,1076],{"class":1075},[91,3599,3600,3602],{"class":93,"line":100},[91,3601,70],{"class":673},[91,3603,1084],{"class":1083},[91,3605,3606],{"class":93,"line":106},[91,3607,3608],{"class":1075},"    Lists a user's recent sign-ins that Conditional Access blocked or that a report-only policy would have blocked.\n",[91,3610,3611,3613],{"class":93,"line":112},[91,3612,70],{"class":673},[91,3614,1096],{"class":1083},[91,3616,3617],{"class":93,"line":707},[91,3618,3619],{"class":1075},"    Queries the Microsoft Graph sign-in logs for one user over a recent window and returns one row per\n",[91,3621,3622],{"class":93,"line":715},[91,3623,3624],{"class":1075},"    failing Conditional Access policy result: time, app, error code, failure reason, device OS,\n",[91,3626,3627],{"class":93,"line":730},[91,3628,3629],{"class":1075},"    compliance flag, policy, result, and correlation ID. Sends Prefer: include-unknown-enum-members so\n",[91,3631,3632],{"class":93,"line":744},[91,3633,3634],{"class":1075},"    report-only results (reportOnlyFailure, reportOnlyInterrupted) are returned.\n",[91,3636,3637,3639,3641],{"class":93,"line":750},[91,3638,70],{"class":673},[91,3640,1123],{"class":1083},[91,3642,3643],{"class":1083}," UserPrincipalName\n",[91,3645,3646],{"class":93,"line":758},[91,3647,3648],{"class":1075},"    UPN of the user who reported the problem.\n",[91,3650,3651,3653,3655],{"class":93,"line":770},[91,3652,70],{"class":673},[91,3654,1123],{"class":1083},[91,3656,3657],{"class":1083}," Hours\n",[91,3659,3660],{"class":93,"line":775},[91,3661,3662],{"class":1075},"    How many hours back to look. Default 24.\n",[91,3664,3665,3667],{"class":93,"line":793},[91,3666,70],{"class":673},[91,3668,1157],{"class":1083},[91,3670,3671],{"class":93,"line":799},[91,3672,3673],{"class":1075},"    .\\Get-CaSignInFailure.ps1 -UserPrincipalName \"user@example.com\" -Hours 8\n",[91,3675,3676,3678],{"class":93,"line":807},[91,3677,70],{"class":673},[91,3679,1169],{"class":1083},[91,3681,3682],{"class":93,"line":820},[91,3683,1174],{"class":1075},[91,3685,3686],{"class":93,"line":833},[91,3687,1179],{"class":1075},[91,3689,3690],{"class":93,"line":839},[91,3691,3692],{"class":1075},"    Requires: PowerShell 7+, Microsoft.Graph.Authentication, AuditLog.Read.All and Policy.Read.All,\n",[91,3694,3695],{"class":93,"line":991},[91,3696,3697],{"class":1075},"              Security Reader (or another role that reads sign-in logs and Conditional Access data)\n",[91,3699,3700],{"class":93,"line":1010},[91,3701,1194],{"class":1075},[91,3703,3704,3706,3708],{"class":93,"line":1015},[91,3705,1200],{"class":667},[91,3707,1203],{"class":673},[91,3709,3710],{"class":667},"()]\n",[91,3712,3713,3715],{"class":93,"line":1197},[91,3714,1225],{"class":1083},[91,3716,1228],{"class":667},[91,3718,3719,3721,3723,3725,3727,3729,3731],{"class":93,"line":1222},[91,3720,1234],{"class":667},[91,3722,1237],{"class":673},[91,3724,1206],{"class":667},[91,3726,1242],{"class":1209},[91,3728,1213],{"class":1083},[91,3730,1216],{"class":673},[91,3732,1219],{"class":667},[91,3734,3735,3737,3739,3742],{"class":93,"line":1231},[91,3736,1234],{"class":667},[91,3738,1256],{"class":1083},[91,3740,3741],{"class":667},"]$UserPrincipalName",[91,3743,684],{"class":1083},[91,3745,3746],{"class":93,"line":1251},[91,3747,1268],{"emptyLinePlaceholder":1267},[91,3749,3750,3752,3755,3757,3760,3762,3765],{"class":93,"line":1264},[91,3751,1234],{"class":667},[91,3753,3754],{"class":673},"ValidateRange",[91,3756,1206],{"class":667},[91,3758,3759],{"class":673},"1",[91,3761,1341],{"class":1083},[91,3763,3764],{"class":673}," 720",[91,3766,1219],{"class":667},[91,3768,3769,3771,3774,3777,3779],{"class":93,"line":1271},[91,3770,1234],{"class":667},[91,3772,3773],{"class":1083},"int",[91,3775,3776],{"class":667},"]$Hours ",[91,3778,1368],{"class":1083},[91,3780,3781],{"class":673}," 24\n",[91,3783,3784],{"class":93,"line":1282},[91,3785,1285],{"class":667},[91,3787,3788],{"class":93,"line":1288},[91,3789,1268],{"emptyLinePlaceholder":1267},[91,3791,3792,3794,3796],{"class":93,"line":1293},[91,3793,1296],{"class":673},[91,3795,1213],{"class":1083},[91,3797,1301],{"class":680},[91,3799,3800,3802],{"class":93,"line":1304},[91,3801,1307],{"class":673},[91,3803,3804],{"class":667}," Microsoft.Graph.Authentication\n",[91,3806,3807,3809,3811,3813,3816,3818,3821,3823],{"class":93,"line":1313},[91,3808,1329],{"class":673},[91,3810,1332],{"class":1083},[91,3812,1335],{"class":667},[91,3814,3815],{"class":680},"'AuditLog.Read.All'",[91,3817,1341],{"class":1083},[91,3819,3820],{"class":680}," 'Policy.Read.All'",[91,3822,1332],{"class":1083},[91,3824,1354],{"class":667},[91,3826,3827],{"class":93,"line":1321},[91,3828,1268],{"emptyLinePlaceholder":1267},[91,3830,3831,3834,3836,3838,3841,3844,3847,3850,3853],{"class":93,"line":1326},[91,3832,3833],{"class":667},"$since ",[91,3835,1368],{"class":1083},[91,3837,1663],{"class":667},[91,3839,3840],{"class":673},"Get-Date",[91,3842,3843],{"class":667},").ToUniversalTime().AddHours(",[91,3845,3846],{"class":1083},"-",[91,3848,3849],{"class":667},"$Hours).ToString(",[91,3851,3852],{"class":680},"'yyyy-MM-ddTHH:mm:ssZ'",[91,3854,1285],{"class":667},[91,3856,3857,3860,3862,3865,3868,3870,3873],{"class":93,"line":1357},[91,3858,3859],{"class":667},"$upn ",[91,3861,1368],{"class":1083},[91,3863,3864],{"class":667}," $UserPrincipalName.ToLower().Replace(",[91,3866,3867],{"class":680},"\"'\"",[91,3869,1341],{"class":1083},[91,3871,3872],{"class":680}," \"''\"",[91,3874,1285],{"class":667},[91,3876,3877,3880,3882,3885,3888,3891,3894],{"class":93,"line":1362},[91,3878,3879],{"class":667},"$filter ",[91,3881,1368],{"class":1083},[91,3883,3884],{"class":680}," \"userPrincipalName eq '",[91,3886,3887],{"class":667},"$upn",[91,3889,3890],{"class":680},"' and createdDateTime ge ",[91,3892,3893],{"class":667},"$since",[91,3895,3896],{"class":680},"\"\n",[91,3898,3899,3902,3904,3907,3910,3913,3915,3918,3921,3924,3927,3930,3933,3935],{"class":93,"line":1374},[91,3900,3901],{"class":667},"$uri ",[91,3903,1368],{"class":1083},[91,3905,3906],{"class":680}," \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002FauditLogs\u002FsignIns?",[91,3908,3909],{"class":673},"`$",[91,3911,3912],{"class":680},"filter=",[91,3914,3179],{"class":1083},[91,3916,3917],{"class":680},"([",[91,3919,3920],{"class":1083},"uri",[91,3922,3923],{"class":680},"]::EscapeDataString(",[91,3925,3926],{"class":667},"$filter",[91,3928,3929],{"class":680},"))",[91,3931,3932],{"class":680},"&",[91,3934,3909],{"class":673},[91,3936,3937],{"class":680},"top=100\"\n",[91,3939,3940,3943,3945,3947,3950,3952,3955],{"class":93,"line":1379},[91,3941,3942],{"class":667},"$headers ",[91,3944,1368],{"class":1083},[91,3946,1393],{"class":1083},[91,3948,3949],{"class":667},"{ Prefer ",[91,3951,1368],{"class":1083},[91,3953,3954],{"class":680}," 'include-unknown-enum-members'",[91,3956,1007],{"class":667},[91,3958,3959,3962,3964,3966,3968,3971,3973,3976,3978,3981],{"class":93,"line":1385},[91,3960,3961],{"class":667},"$interesting ",[91,3963,1368],{"class":1083},[91,3965,1393],{"class":1083},[91,3967,1206],{"class":667},[91,3969,3970],{"class":680},"'failure'",[91,3972,1341],{"class":1083},[91,3974,3975],{"class":680}," 'reportOnlyFailure'",[91,3977,1341],{"class":1083},[91,3979,3980],{"class":680}," 'reportOnlyInterrupted'",[91,3982,1285],{"class":667},[91,3984,3985],{"class":93,"line":1399},[91,3986,1268],{"emptyLinePlaceholder":1267},[91,3988,3989,3992],{"class":93,"line":1407},[91,3990,3991],{"class":1083},"while",[91,3993,3994],{"class":667}," ($uri) {\n",[91,3996,3997,4000,4002,4005,4007,4010,4012,4015,4017],{"class":93,"line":1415},[91,3998,3999],{"class":667},"    $page ",[91,4001,1368],{"class":1083},[91,4003,4004],{"class":673}," Invoke-MgGraphRequest",[91,4006,1332],{"class":1083},[91,4008,4009],{"class":667},"Method GET ",[91,4011,3846],{"class":1083},[91,4013,4014],{"class":667},"Uri $uri ",[91,4016,3846],{"class":1083},[91,4018,4019],{"class":667},"Headers $headers\n",[91,4021,4022,4025,4028,4030,4033,4036],{"class":93,"line":1423},[91,4023,4024],{"class":1083},"    foreach",[91,4026,4027],{"class":667}," ($signIn ",[91,4029,3149],{"class":1083},[91,4031,4032],{"class":667}," $page[",[91,4034,4035],{"class":680},"'value'",[91,4037,4038],{"class":667},"]) {\n",[91,4040,4041,4044,4046,4048,4051,4054],{"class":93,"line":1431},[91,4042,4043],{"class":1083},"        foreach",[91,4045,3146],{"class":667},[91,4047,3149],{"class":1083},[91,4049,4050],{"class":667}," $signIn[",[91,4052,4053],{"class":680},"'appliedConditionalAccessPolicies'",[91,4055,4038],{"class":667},[91,4057,4058,4061,4064,4066,4069,4072],{"class":93,"line":1439},[91,4059,4060],{"class":1083},"            if",[91,4062,4063],{"class":667}," ($interesting ",[91,4065,3164],{"class":1083},[91,4067,4068],{"class":667}," $policy[",[91,4070,4071],{"class":680},"'result'",[91,4073,4038],{"class":667},[91,4075,4076,4079,4081,4083,4085],{"class":93,"line":1447},[91,4077,4078],{"class":667},"                [",[91,4080,3252],{"class":1083},[91,4082,3255],{"class":667},[91,4084,1863],{"class":1083},[91,4086,668],{"class":667},[91,4088,4089,4092,4094,4096,4099],{"class":93,"line":1455},[91,4090,4091],{"class":667},"                    Time          ",[91,4093,1368],{"class":1083},[91,4095,4050],{"class":667},[91,4097,4098],{"class":680},"'createdDateTime'",[91,4100,741],{"class":667},[91,4102,4103,4106,4108,4110,4113],{"class":93,"line":1463},[91,4104,4105],{"class":667},"                    App           ",[91,4107,1368],{"class":1083},[91,4109,4050],{"class":667},[91,4111,4112],{"class":680},"'appDisplayName'",[91,4114,741],{"class":667},[91,4116,4117,4120,4122,4124,4127,4130,4133],{"class":93,"line":1471},[91,4118,4119],{"class":667},"                    ErrorCode     ",[91,4121,1368],{"class":1083},[91,4123,4050],{"class":667},[91,4125,4126],{"class":680},"'status'",[91,4128,4129],{"class":667},"][",[91,4131,4132],{"class":680},"'errorCode'",[91,4134,741],{"class":667},[91,4136,4137,4140,4142,4144,4146,4148,4151],{"class":93,"line":1479},[91,4138,4139],{"class":667},"                    FailureReason ",[91,4141,1368],{"class":1083},[91,4143,4050],{"class":667},[91,4145,4126],{"class":680},[91,4147,4129],{"class":667},[91,4149,4150],{"class":680},"'failureReason'",[91,4152,741],{"class":667},[91,4154,4155,4158,4160,4162,4165,4167,4170],{"class":93,"line":1487},[91,4156,4157],{"class":667},"                    OS            ",[91,4159,1368],{"class":1083},[91,4161,4050],{"class":667},[91,4163,4164],{"class":680},"'deviceDetail'",[91,4166,4129],{"class":667},[91,4168,4169],{"class":680},"'operatingSystem'",[91,4171,741],{"class":667},[91,4173,4174,4177,4179,4181,4183,4185,4188],{"class":93,"line":1495},[91,4175,4176],{"class":667},"                    IsCompliant   ",[91,4178,1368],{"class":1083},[91,4180,4050],{"class":667},[91,4182,4164],{"class":680},[91,4184,4129],{"class":667},[91,4186,4187],{"class":680},"'isCompliant'",[91,4189,741],{"class":667},[91,4191,4192,4195,4197,4199,4202],{"class":93,"line":1503},[91,4193,4194],{"class":667},"                    Policy        ",[91,4196,1368],{"class":1083},[91,4198,4068],{"class":667},[91,4200,4201],{"class":680},"'displayName'",[91,4203,741],{"class":667},[91,4205,4206,4209,4211,4213,4215],{"class":93,"line":1509},[91,4207,4208],{"class":667},"                    Result        ",[91,4210,1368],{"class":1083},[91,4212,4068],{"class":667},[91,4214,4071],{"class":680},[91,4216,741],{"class":667},[91,4218,4219,4222,4224,4226,4229],{"class":93,"line":1514},[91,4220,4221],{"class":667},"                    CorrelationId ",[91,4223,1368],{"class":1083},[91,4225,4050],{"class":667},[91,4227,4228],{"class":680},"'correlationId'",[91,4230,741],{"class":667},[91,4232,4233],{"class":93,"line":1519},[91,4234,4235],{"class":667},"                }\n",[91,4237,4238],{"class":93,"line":1525},[91,4239,4240],{"class":667},"            }\n",[91,4242,4243],{"class":93,"line":1536},[91,4244,2411],{"class":667},[91,4246,4247],{"class":93,"line":1541},[91,4248,1971],{"class":667},[91,4250,4251,4254,4256,4258,4261],{"class":93,"line":1547},[91,4252,4253],{"class":667},"    $uri ",[91,4255,1368],{"class":1083},[91,4257,4032],{"class":667},[91,4259,4260],{"class":680},"'@odata.nextLink'",[91,4262,741],{"class":667},[91,4264,4265],{"class":93,"line":1571},[91,4266,842],{"class":667},[11,4268,4269,4270,4273],{},"If the ",[37,4271,4272],{},"Policy"," column comes back empty on every row, the signed-in tech has a role that reads sign-in logs but not Conditional Access data. That's the Reports Reader gap from the table, showing up in practice.",[18,4275,4277],{"id":4276},"intune-compliance-the-grace-period-is-a-setting-not-a-hope","Intune compliance: the grace period is a setting, not a hope",[11,4279,4280],{},"Most \"compliance lag\" lockouts come from Intune defaults nobody revisited:",[26,4282,4283,4298,4312,4318],{},[29,4284,4285,4286,4289,4290,4293,4294,4297],{},"Every compliance policy includes ",[32,4287,4288],{},"Mark device noncompliant"," at ",[32,4291,4292],{},"0 days",", so a device that fails a rule is noncompliant, and blocked by CA006, immediately. Raising that schedule is the documented way to give users a grace period; the admin center accepts values in 0.25-day steps (0.25 is six hours). Pair it with a ",[32,4295,4296],{},"Send email to end user"," action at 0 days so the user hears about it before the block.",[29,4299,4300,4303,4304,4307,4308,4311],{},[32,4301,4302],{},"Mark devices with no compliance policy assigned as"," defaults to ",[32,4305,4306],{},"Compliant",". Microsoft recommends ",[32,4309,4310],{},"Not compliant"," when you use Conditional Access, but flipping it before every device has an assigned policy is its own lockout. Check assignments first.",[29,4313,4314,4317],{},[32,4315,4316],{},"Compliance status validity period"," defaults to 30 days (1 to 120). A device that doesn't report within it becomes noncompliant, which is how a laptop that sat in a drawer shows up as a help desk call.",[29,4319,4320,4321,4326],{},"Compliance is evaluated when the device checks in, so a user who just fixed the problem may still be blocked until the next check-in. The companion script ",[4322,4323,4325],"a",{"href":4324},"\u002F2025\u002F10\u002F22\u002Fpowershell-intune-force-a-compliance-policy-re-evaluation-fleet-wide\u002F","PowerShell: Intune – Force a Compliance Policy Re-evaluation Fleet-Wide"," shortens that wait.",[18,4328,4330],{"id":4329},"treat-every-policy-as-reversible-until-proven-otherwise","Treat every policy as reversible until proven otherwise",[11,4332,4333],{},"Never ship a new or modified Conditional Access policy without first confirming how to undo it quickly, with a tested rollback. A policy that can't be reversed in under five minutes by someone other than its author isn't ready to enforce. The fastest rollback that keeps the evidence is flipping the policy back to report-only, which disables enforcement while it keeps logging what the policy would have done:",[82,4335,4337],{"className":1066,"code":4336,"language":1068,"meta":87,"style":87},"Update-MgIdentityConditionalAccessPolicy -ConditionalAccessPolicyId \"\u003Cpolicy-id>\" -State \"enabledForReportingButNotEnforced\"\n",[37,4338,4339],{"__ignoreMap":87},[91,4340,4341,4344,4346,4349,4352,4354,4357],{"class":93,"line":94},[91,4342,4343],{"class":673},"Update-MgIdentityConditionalAccessPolicy",[91,4345,1332],{"class":1083},[91,4347,4348],{"class":667},"ConditionalAccessPolicyId ",[91,4350,4351],{"class":680},"\"\u003Cpolicy-id>\"",[91,4353,1332],{"class":1083},[91,4355,4356],{"class":667},"State ",[91,4358,4359],{"class":680},"\"enabledForReportingButNotEnforced\"\n",[11,4361,4362,4363,4366,4367,4370,4371,4374],{},"Know what rollback doesn't reset. Conditional Access is evaluated when a token is issued. Access tokens last one hour by default, but clients in Continuous Access Evaluation sessions get long-lived tokens of up to 28 hours. Microsoft also documents that Conditional Access policy and group membership changes can take up to a day to take effect at resource providers like Exchange Online and SharePoint Online (optimizations bring policy updates down to about two hours, but not in every scenario). When a change must apply to specific users right away, revoke their sessions (",[37,4364,4365],{},"Revoke-MgUserSignInSession -UserId \"\u003Cuser-id>\"",", which needs ",[37,4368,4369],{},"User.RevokeSessions.All",") or use ",[32,4372,4373],{},"Revoke sessions"," on the user's profile. And if every admin is locked out, Microsoft's documented last resort is a support request, which is exactly why the emergency access accounts come first.",[11,4376,4377,4378,4382],{},"To catch the slow version of this problem (a \"temporary\" exclusion that never gets removed, or a break-glass group that quietly drops off a policy), I run ",[4322,4379,4381],{"href":4380},"\u002F2025\u002F08\u002F06\u002Fpowershell-entra-id-audit-conditional-access-policy-drift\u002F","PowerShell: Entra ID – Audit Conditional Access Policy Drift"," on a schedule against a baseline taken right after rollout.",[18,4384,4386],{"id":4385},"references","References",[26,4388,4389,4397,4404,4410,4417,4450,4462,4474,4486,4498],{},[29,4390,4391],{},[4322,4392,4396],{"href":4393,"rel":4394},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Frole-based-access-control\u002Fsecurity-emergency-access",[4395],"nofollow","Manage emergency access admin accounts",[29,4398,4399],{},[4322,4400,4403],{"href":4401,"rel":4402},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fconditional-access\u002Fconcept-conditional-access-report-only",[4395],"Report-only mode, policy impact, and evaluation results",[29,4405,4406],{},[4322,4407,3369],{"href":4408,"rel":4409},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fconditional-access\u002Fhowto-conditional-access-insights-reporting",[4395],[29,4411,4412],{},[4322,4413,4416],{"href":4414,"rel":4415},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fconditional-access\u002Fmanaged-policies",[4395],"Microsoft-managed Conditional Access policies",[29,4418,4419,4420,620,4425,620,4430,620,4435,620,4440,620,4445],{},"Policy templates: ",[4322,4421,4424],{"href":4422,"rel":4423},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fconditional-access\u002Fpolicy-admin-phish-resistant-mfa",[4395],"phishing-resistant MFA for admins",[4322,4426,4429],{"href":4427,"rel":4428},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fconditional-access\u002Fpolicy-block-legacy-authentication",[4395],"block legacy authentication",[4322,4431,4434],{"href":4432,"rel":4433},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fconditional-access\u002Fpolicy-all-users-mfa-strength",[4395],"MFA for all users",[4322,4436,4439],{"href":4437,"rel":4438},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fconditional-access\u002Fpolicy-old-require-mfa-azure-mgmt",[4395],"MFA for Azure management",[4322,4441,4444],{"href":4442,"rel":4443},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fconditional-access\u002Fpolicy-all-users-security-info-registration",[4395],"security info registration",[4322,4446,4449],{"href":4447,"rel":4448},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fconditional-access\u002Fpolicy-all-users-device-compliance",[4395],"device compliance",[29,4451,4452,66,4457],{},[4322,4453,4456],{"href":4454,"rel":4455},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fgraph\u002Fapi\u002Fresources\u002Fconditionalaccesspolicy?view=graph-rest-1.0",[4395],"conditionalAccessPolicy resource type (Microsoft Graph v1.0)",[4322,4458,4461],{"href":4459,"rel":4460},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fgraph\u002Fapi\u002Fconditionalaccessroot-post-policies?view=graph-rest-1.0",[4395],"Create conditionalAccessPolicy",[29,4463,4464,66,4469],{},[4322,4465,4468],{"href":4466,"rel":4467},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fconditional-access\u002Ftroubleshoot-conditional-access",[4395],"Troubleshooting sign-in problems with Conditional Access",[4322,4470,4473],{"href":4471,"rel":4472},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fconditional-access\u002Fwhat-if-tool",[4395],"the What If tool",[29,4475,4476,66,4481],{},[4322,4477,4480],{"href":4478,"rel":4479},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Frole-based-access-control\u002Fpermissions-reference",[4395],"Microsoft Entra built-in roles",[4322,4482,4485],{"href":4483,"rel":4484},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fgraph\u002Fapi\u002Fsignin-list?view=graph-rest-1.0",[4395],"List signIns permissions",[29,4487,4488,66,4493],{},[4322,4489,4492],{"href":4490,"rel":4491},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fintune\u002Fintune-service\u002Fprotect\u002Factions-for-noncompliance",[4395],"Intune actions for noncompliance",[4322,4494,4497],{"href":4495,"rel":4496},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fintune\u002Fintune-service\u002Fprotect\u002Fdevice-compliance-get-started",[4395],"compliance policy settings",[29,4499,4500],{},[4322,4501,4504],{"href":4502,"rel":4503},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fconditional-access\u002Fconcept-continuous-access-evaluation",[4395],"Continuous access evaluation",[4506,4507,4508],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .s95oV, html code.shiki .s95oV{--shiki-default:#E1E4E8}html pre.shiki code .sDLfK, html code.shiki .sDLfK{--shiki-default:#79B8FF}html pre.shiki code .sU2Wk, html code.shiki .sU2Wk{--shiki-default:#9ECBFF}html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html pre.shiki code .snl16, html code.shiki .snl16{--shiki-default:#F97583}html pre.shiki code .s9osk, html code.shiki .s9osk{--shiki-default:#FFAB70}",{"title":87,"searchDepth":100,"depth":100,"links":4510},[4511,4512,4521,4522,4523,4524,4525,4526,4527],{"id":20,"depth":100,"text":21},{"id":125,"depth":100,"text":126,"children":4513},[4514,4515,4516,4517,4518,4519,4520],{"id":133,"depth":106,"text":134},{"id":217,"depth":106,"text":218},{"id":282,"depth":106,"text":283},{"id":349,"depth":106,"text":350},{"id":410,"depth":106,"text":411},{"id":474,"depth":106,"text":475},{"id":538,"depth":106,"text":539},{"id":608,"depth":100,"text":609},{"id":1027,"depth":100,"text":1028},{"id":3324,"depth":100,"text":3325},{"id":3463,"depth":100,"text":3464},{"id":4276,"depth":100,"text":4277},{"id":4329,"depth":100,"text":4330},{"id":4385,"depth":100,"text":4386},"techcolumnist",[4530],"engineering","2026-08-05T14:00:00Z","Seven concrete Entra ID Conditional Access policies, the Graph JSON and PowerShell to create them in report-only, and the roles and queries your help desk needs.","md",false,null,{},"\u002Fblog\u002F2026\u002F08\u002F05\u002Fintune-conditional-access-policies-that-don-t-lock-out-your-help-desk",{"title":6,"description":4532},[4528],"blog\u002F2026\u002F08\u002F05\u002Fintune-conditional-access-policies-that-don-t-lock-out-your-help-desk",[4542,4543],"intune","entra-id","\u002F2026\u002F08\u002F05\u002Fintune-conditional-access-policies-that-don-t-lock-out-your-help-desk\u002F","UQzUAONrHUN_buyyF8UHup-hdwiJuVaG1Bb1z0sJXVM",{"title":4547,"description":4548,"date":4549,"url":4550,"categories":4551,"tags":4553,"image":4535,"readingTime":730,"canonical":4528,"sites":4555,"series":4535,"seriesOrder":4535},"Azure: Cost Governance Without Killing Developer Velocity","Azure cost governance that catches waste without approval gates: built-in policy guardrails, budget alerts as code, and scheduled cleanup, with the scripts.","2026-08-12T14:00:00Z","\u002F2026\u002F08\u002F12\u002Fazure-cost-governance-without-killing-developer-velocity\u002F",[4530,4552],"strategy",[4554],"azure",[4528],{"title":4557,"description":4558,"date":4559,"url":4560,"categories":4561,"tags":4562,"image":4535,"readingTime":744,"canonical":4528,"sites":4565,"series":4535,"seriesOrder":4535},"Infrastructure: What a Real Disaster Recovery Test Actually Reveals","What a real DR failover exposes that a tabletop never catches, with a Hyper-V Replica test failover script that checks each recovered VM and a runbook checklist.","2026-07-22T14:00:00Z","\u002F2026\u002F07\u002F22\u002Finfrastructure-what-a-real-disaster-recovery-test-actually-reveals\u002F",[4530,4552],[4563,4564],"backup","hyper-v",[4528],[4567,4578,4587],{"title":4568,"description":4569,"date":4570,"url":4571,"categories":4572,"tags":4573,"image":4535,"readingTime":744,"canonical":4528,"sites":4577,"series":4535,"seriesOrder":4535},"Windows 11: A Debloat and Hardening Baseline for New Deployments","A repeatable Windows 11 baseline: policy-based app removal, Microsoft security baselines, BitLocker, Defender and ASR settings, plus a fleet audit script.","2026-06-17T14:00:00Z","\u002F2026\u002F06\u002F17\u002Fwindows-11-a-debloat-and-hardening-baseline-for-new-deployments\u002F",[4530],[4574,4575,4576,4542],"windows-11","debloat","gpo",[4528],{"title":4579,"description":4580,"date":4581,"url":4582,"categories":4583,"tags":4584,"image":4535,"readingTime":744,"canonical":4528,"sites":4586,"series":4535,"seriesOrder":4535},"Intune: Autopilot Provisioning Failures and How to Actually Debug Them","Debugging Windows Autopilot failures from the evidence: documented error codes, event IDs, ESP tracking and timeouts, log collection, and triage scripts for device and Graph.","2026-04-08T14:00:00Z","\u002F2026\u002F04\u002F08\u002Fintune-autopilot-provisioning-failures-and-how-to-actually-debug-them\u002F",[4530],[4542,4585],"windows",[4528],{"title":4588,"description":4589,"date":4590,"url":4591,"categories":4592,"tags":4593,"image":4535,"readingTime":730,"canonical":4528,"sites":4595,"series":4535,"seriesOrder":4535},"Intune: Migrating From Group Policy to Cloud-Native Management","Moving a Windows estate from Group Policy to Intune: GPO inventory script, Group Policy analytics, Settings catalog migration, MDMWinsOverGP and conflict checks.","2026-04-01T14:00:00Z","\u002F2026\u002F04\u002F01\u002Fintune-migrating-from-group-policy-to-cloud-native-endpoint-management\u002F",[4530,4552],[4542,4576,4585,4594],"active-directory",[4528],{"doc":4535,"posts":4597},[],1790052514081]