AZ_CAP_APPLIES_TO

Copy page

Summary


Forestall ACL Alias	AZ_CAP_APPLIES_TO
Entra ID (Azure AD) Alias	Conditional Access Policy - Included Users/Groups/Roles
Affected Object Types	Conditional Access Policy -> Users, Groups, Service Principals
Edge Direction	AZConditionalAccessPolicy -> Principal
Exploitation Certainty	Informational

Description

AZ_CAP_APPLIES_TO connects a Conditional Access Policy (AZConditionalAccessPolicy) to the principals it governs - the users, groups, and service principals in the policy’s include assignments. A policy governs principals (who it applies to) and separately covers resources (the cloud apps it protects); this edge answers the “who” question. The resource side is AZ_CAP_PROTECTS, and the exclusions are AZ_CAP_EXCLUDES.

The collector expands the policy’s include targets into concrete principals:

Include users - direct user assignments; the All sentinel expands to every user in the tenant, and GuestsOrExternalUsers expands to guest and external users.
Include groups - assigned groups.
Include roles - every user, group, and service principal that currently holds an included directory role (active assignments only).

This edge is informational: it shows Conditional Access coverage, which is central to identifying gaps (principals no policy governs) and to reasoning about whether a control such as MFA actually reaches a given identity. It is not an exploitable permission on its own.

Identification

PowerShell (Microsoft Graph)

Connect-MgGraph -Scopes "Policy.Read.All","Directory.Read.All"

Get-MgIdentityConditionalAccessPolicy -All |
  Select-Object DisplayName, State,
    @{N='IncludeUsers';E={$_.Conditions.Users.IncludeUsers -join ', '}},
    @{N='IncludeGroups';E={$_.Conditions.Users.IncludeGroups -join ', '}},
    @{N='IncludeRoles';E={$_.Conditions.Users.IncludeRoles -join ', '}} |
  Format-Table -AutoSize

Exploitation

There is no direct exploit for this edge; it records which principals a Conditional Access Policy governs. It is used to find coverage gaps and to confirm whether protections apply to a given identity. See AZ_CAP_EXCLUDES for exclusions that can create silent gaps, and AZ_CAP_PROTECTS for the resources side.

Mitigation

Ensure critical protections (admin MFA, all-user MFA) apply to the intended principals with no unintended narrowing.
Prefer group-based assignment with tightly controlled membership over ad-hoc individual assignment.
Review policies whose include targets are All together with their exclusions to confirm real coverage.

Detection

Use the Microsoft Entra admin center:

Open Microsoft Entra ID -> Audit logs and filter for Conditional Access policy changes.
Review Initiated by (actor), Target (the policy), Date, and Status for unexpected assignment changes.
Use Conditional Access -> Insights and reporting to confirm which identities are actually in scope.

Ask AI