AZ_CAP_APPLIES_TO

Summary

Forestall ACL Alias	AZ_CAP_APPLIES_TO
Entra ID (Azure AD) Alias	Conditional Access Policy - Included Users/Groups/Roles
Affected Object Types	Conditional Access Policy -> Users, Groups, Service Principals
Edge Direction	AZConditionalAccessPolicy -> Principal
Exploitation Certainty	Informational

Description

AZ_CAP_APPLIES_TO connects a Conditional Access Policy (AZConditionalAccessPolicy) to the principals it governs - the users, groups, and service principals in the policy's include assignments. A policy governs principals (who it applies to) and separately covers resources (the cloud apps it protects); this edge answers the "who" question. The resource side is AZ_CAP_PROTECTS, and the exclusions are AZ_CAP_EXCLUDES.

The collector expands the policy's include targets into concrete principals:

• Include users - direct user assignments; the All sentinel expands to every user in the tenant, and GuestsOrExternalUsers expands to guest and external users.

• Include groups - assigned groups.

• Include roles - every user, group, and service principal that currently holds an included directory role (active assignments only).

This edge is informational: it shows Conditional Access coverage, which is central to identifying gaps (principals no policy governs) and to reasoning about whether a control such as MFA actually reaches a given identity. It is not an exploitable permission on its own.

Identification

PowerShell (Microsoft Graph)

Connect-MgGraph -Scopes "Policy.Read.All","Directory.Read.All"

Get-MgIdentityConditionalAccessPolicy -All |
  Select-Object DisplayName, State,
    @{N='IncludeUsers';E={$_.Conditions.Users.IncludeUsers -join ', '}},
    @{N='IncludeGroups';E={$_.Conditions.Users.IncludeGroups -join ', '}},
    @{N='IncludeRoles';E={$_.Conditions.Users.IncludeRoles -join ', '}} |
  Format-Table -AutoSize

Azure Portal

1. Open Microsoft Entra admin center -> Protection -> Conditional Access -> Policies.

2. Open a policy -> Assignments -> Users to see the included users, groups, and roles it applies to.

Exploitation

There is no direct exploit for this edge; it records which principals a Conditional Access Policy governs. It is used to find coverage gaps and to confirm whether protections apply to a given identity. See AZ_CAP_EXCLUDES for exclusions that can create silent gaps, and AZ_CAP_PROTECTS for the resources side.

Mitigation

• Ensure critical protections (admin MFA, all-user MFA) apply to the intended principals with no unintended narrowing.

• Prefer group-based assignment with tightly controlled membership over ad-hoc individual assignment.

• Review policies whose include targets are All together with their exclusions to confirm real coverage.

Detection

Use the Microsoft Entra admin center:

1. Open Microsoft Entra ID -> Audit logs and filter for Conditional Access policy changes.

2. Review Initiated by (actor), Target (the policy), Date, and Status for unexpected assignment changes.

3. Use Conditional Access -> Insights and reporting to confirm which identities are actually in scope.

References

• https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-users-groups

• https://learn.microsoft.com/en-us/graph/api/resources/conditionalaccesspolicy

• https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview