Audit Conditional Access Policies with PowerShell
Build a workflow that documents and audits every Conditional Access policy in your tenant — and flags the gaps before an attacker does.
Conditional Access is the heart of modern identity security in Microsoft 365 and Azure. It is also one of the easiest places to drift: one experimental policy here, one excluded test account there, and suddenly nobody is sure what protects what.
A scheduled PowerShell workflow takes the guesswork out. PSForge ships the Conditional Access tasks so you can build that workflow without writing Microsoft Graph calls by hand.
Why CA policies need an audit habit
Conditional Access policies stack up over time. Pilot policies become permanent, exclusions for 'just one user' get forgotten, and report-only policies stay in report-only forever.
Without documentation and a regular audit, you can be one rushed change away from locking out users — or worse, leaving a privileged role completely unprotected.
What an audit workflow should cover
- A full inventory of every CA policy in the tenant
- Which users, groups, and roles each policy applies to (and excludes)
- Apps and platforms targeted by each policy
- Policies still in report-only mode after a long time
- Privileged roles not protected by any MFA-enforcing policy
Example Conditional Access audit workflow
- Connect to Microsoft Graph with the right scopes
- Export every Conditional Access policy with conditions and grant controls
- Resolve user, group, and role exclusions to readable names
- Flag report-only policies older than a configurable threshold
- Highlight privileged roles missing MFA enforcement
- Generate a documented CA report for security review
Final thoughts
Conditional Access is too important to leave undocumented.
With PSForge, you get a workflow that turns CA policy review into a quiet, repeatable monthly task.