> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/cap-audit.md).

# CAP Audit

CAP Audit reports the health of the Conditional Access policies collected from Entra ID. It compares the policies in the scan against a baseline of expected protections and reports which protections are missing, which policies no longer protect anybody, which policies duplicate each other, and which users are not covered by multi-factor authentication.

The module is available when the scan includes Entra ID and its Conditional Access policies have been collected.

## Overview

The Overview page summarises the state of Conditional Access for the selected scan.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-5df5120177af3f8965faf47829ad05b6e611a1ff%2Fcap-audit-overview.png?alt=media" alt=""><figcaption><p>CAP Audit Overview</p></figcaption></figure>

Four cards summarise the findings:

**Protections Not In Place:** The number of baseline protections that are missing or not enforced, out of the total number of baseline protections.

**Ineffective Policies:** The number of policies that currently protect nobody.

**Duplicate Policies:** The number of policies that are identical to another policy.

**Users Without MFA:** The number of users that no enabled policy currently requires multi-factor authentication for.

The **Summary** table below the cards breaks the same information down:

| Row                               | Description                                                                                             |
| --------------------------------- | ------------------------------------------------------------------------------------------------------- |
| **Baseline protections in place** | How many baseline protections are configured and enforced, and the percentage this represents.          |
| **Configured but not enforced**   | Protections that exist as a policy but are not enforced, for example a policy left in report-only mode. |
| **Missing entirely**              | Baseline protections with no matching policy at all.                                                    |
| **Policies protecting nobody**    | Policies whose assignment resolves to no user.                                                          |
| **Duplicate policies**            | Policies that duplicate another policy.                                                                 |

**Coverage over time** charts how baseline coverage has changed across recent scans, so a drop in protection is visible between scans. The number of scans shown can be adjusted.

{% hint style="info" %}
If the selected scan is not the most recent one, the page shows a notice that the results are from an older scan.
{% endhint %}

## User Summary

The User Summary page lists the users in the scan and the Conditional Access policies that apply to each of them.

**Name:** The user the row is about.

**Applicable Policies:** The policies that currently apply to that user.

This page answers the opposite question to Gap Analysis: instead of asking which protections are missing overall, it shows what a specific user is actually protected by, which is useful when investigating an account that was compromised or is suspected of being over-exposed.

## Gap Analysis

Gap Analysis compares the policies in the scan against the baseline protections and lists every gap.

**Status:** Whether the protection is in place, configured but not enforced, or missing entirely.

**Priority:** How important the protection is relative to the others.

**Protection:** The baseline protection the row is about.

**Why it matters:** What the protection defends against, in plain language.

**What to do:** The recommended action to close the gap.

**Policies:** The policies, if any, that relate to the protection.

## Ineffective Policies

Ineffective Policies lists the policies that are enabled but currently protect nobody, for example because every user in scope is also excluded, or because the assignment resolves to an empty set.

**Policy:** The policy that has no effect.

**What to do:** The recommended action, such as correcting the assignment or removing the policy.

## Duplicate Policies

Duplicate Policies lists policies that are identical to another policy. Duplicates make the policy set harder to reason about and mean a change has to be made in more than one place to take effect.

**Group:** The group of policies that duplicate each other.

**Policy:** The policy the row is about.

**Duplicates:** The policy or policies it duplicates.

**Description:** The description of the policy.

{% hint style="info" %}
The Conditional Access policies themselves, including what each one applies to and demands, are documented on the [Conditional Access Policies](/forestall/unified-identities/azure-identities/entra-id/conditional-access-policies.md) entity page.
{% endhint %}