Entra ID Conditional Access Audit

1#Requires -Modules Microsoft.Graph.Identity.SignIns, Microsoft.Graph.Groups2<#3.SYNOPSIS4    Audits Entra ID conditional access policies and flags common gaps.5 6.PARAMETER OutputPath7    Directory for the CSV exports. Created if missing.8 9.PARAMETER StaleReportOnlyDays10    Age at which a report-only policy is considered abandoned.11 12.EXAMPLE13    .\Invoke-CaAudit.ps1 -OutputPath C:\Audit -StaleReportOnlyDays 3014#>15[CmdletBinding()]16param(17    [string] $OutputPath = ".\ca-audit",18    [int]    $StaleReportOnlyDays = 3019)20 21Connect-MgGraph -Scopes "Policy.Read.All","Directory.Read.All","RoleManagement.Read.Directory" -NoWelcome22New-Item -ItemType Directory -Path $OutputPath -Force | Out-Null23 24$nameCache = @{}25function Resolve-DirectoryName {26    param([string] $Id)27    if ([string]::IsNullOrWhiteSpace($Id)) { return "" }28    if ($Id -eq "All" -or $Id -eq "None" -or $Id -eq "GuestsOrExternalUsers") { return $Id }29    if ($nameCache.ContainsKey($Id)) { return $nameCache[$Id] }30 31    $name = $Id32    try   { $name = (Get-MgDirectoryObject -DirectoryObjectId $Id).AdditionalProperties.displayName }33    catch { Write-Verbose "Could not resolve $Id" }34 35    $nameCache[$Id] = $name36    return $name37}38 39Write-Host "Reading conditional access policies..." -ForegroundColor Cyan40$policies = Get-MgIdentityConditionalAccessPolicy -All41 42$rows = foreach ($p in $policies) {43    [pscustomobject]@{44        Name             = $p.DisplayName45        State            = $p.State46        Created          = $p.CreatedDateTime47        Modified         = $p.ModifiedDateTime48        IncludeUsers     = ($p.Conditions.Users.IncludeUsers | ForEach-Object { Resolve-DirectoryName $_ }) -join "; "49        ExcludeUsers     = ($p.Conditions.Users.ExcludeUsers | ForEach-Object { Resolve-DirectoryName $_ }) -join "; "50        IncludeGroups    = ($p.Conditions.Users.IncludeGroups | ForEach-Object { Resolve-DirectoryName $_ }) -join "; "51        ExcludeGroups    = ($p.Conditions.Users.ExcludeGroups | ForEach-Object { Resolve-DirectoryName $_ }) -join "; "52        IncludeApps      = ($p.Conditions.Applications.IncludeApplications) -join "; "53        GrantControls    = ($p.GrantControls.BuiltInControls) -join "; "54        GrantOperator    = $p.GrantControls.Operator55        SessionControls  = if ($p.SessionControls) { "Yes" } else { "No" }56    }57}58 59$rows | Sort-Object Name | Export-Csv -Path (Join-Path $OutputPath "policies.csv") -NoTypeInformation -Encoding UTF860 61# ── Findings ─────────────────────────────────────────────────────────────62$privilegedIds = @()63try {64    $privilegedIds = Get-MgRoleManagementDirectoryRoleAssignment -All |65        Select-Object -ExpandProperty PrincipalId -Unique66} catch { Write-Warning "Could not enumerate role assignments; privileged-exclusion check skipped." }67 68$cutoff   = (Get-Date).AddDays(-$StaleReportOnlyDays)69$findings = New-Object System.Collections.Generic.List[object]70 71foreach ($p in $policies) {72    if ($p.State -eq "enabledForReportingButNotEnforced" -and $p.CreatedDateTime -lt $cutoff) {73        $findings.Add([pscustomobject]@{74            Policy = $p.DisplayName; Severity = "Medium"75            Finding = "Report-only for more than $StaleReportOnlyDays days - enforce it or delete it"76        })77    }78 79    if (-not $p.Conditions.Users.IncludeUsers -and -not $p.Conditions.Users.IncludeGroups -and80        -not $p.Conditions.Users.IncludeRoles) {81        $findings.Add([pscustomobject]@{82            Policy = $p.DisplayName; Severity = "High"83            Finding = "No users, groups or roles assigned - policy applies to nobody"84        })85    }86 87    foreach ($groupId in $p.Conditions.Users.ExcludeGroups) {88        $count = 089        try { $count = (Get-MgGroupMember -GroupId $groupId -All).Count } catch {}90        if ($count -gt 5) {91            $findings.Add([pscustomobject]@{92                Policy = $p.DisplayName; Severity = "High"93                Finding = "Exclusion group '$(Resolve-DirectoryName $groupId)' has $count members"94            })95        }96    }97 98    foreach ($userId in $p.Conditions.Users.ExcludeUsers) {99        if ($privilegedIds -contains $userId) {100            $findings.Add([pscustomobject]@{101                Policy = $p.DisplayName; Severity = "Critical"102                Finding = "Excludes privileged account '$(Resolve-DirectoryName $userId)'"103            })104        }105    }106}107 108$findings | Sort-Object { switch ($_.Severity) { "Critical" {0} "High" {1} default {2} } } |109    Export-Csv -Path (Join-Path $OutputPath "findings.csv") -NoTypeInformation -Encoding UTF8110 111Write-Host ""112Write-Host "$($policies.Count) policies audited, $($findings.Count) findings." -ForegroundColor Green113$findings | Group-Object Severity | ForEach-Object { Write-Host "  $($_.Name): $($_.Count)" }114Disconnect-MgGraph | Out-Null