> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/edges/azure/az_cap_applies_to.md).

# AZ\_CAP\_APPLIES\_TO

## Summary

|                               |                                                                |
| ----------------------------- | -------------------------------------------------------------- |
| **Forestall ACL Alias**       | AZ\_CAP\_APPLIES\_TO                                           |
| **Entra ID (Azure AD) Alias** | Conditional Access Policy - Included Users/Groups/Roles        |
| **Affected Object Types**     | Conditional Access Policy -> Users, Groups, Service Principals |
| **Edge Direction**            | AZConditionalAccessPolicy -> Principal                         |
| **Exploitation Certainty**    | Informational                                                  |

## Description

`AZ_CAP_APPLIES_TO` connects a **Conditional Access Policy** (`AZConditionalAccessPolicy`) to the **principals it governs** - the users, groups, and service principals in the policy's include assignments. A policy governs principals (who it applies to) and separately covers resources (the cloud apps it protects); this edge answers the "who" question. The resource side is [AZ\_CAP\_PROTECTS](https://docs.forestall.io/fsprotect/edges/azure/az_cap_protects), and the exclusions are [AZ\_CAP\_EXCLUDES](https://docs.forestall.io/fsprotect/edges/azure/az_cap_excludes).

The collector expands the policy's include targets into concrete principals:

* **Include users** - direct user assignments; the `All` sentinel expands to every user in the tenant, and `GuestsOrExternalUsers` expands to guest and external users.
* **Include groups** - assigned groups.
* **Include roles** - every user, group, and service principal that currently holds an included directory role (active assignments only).

This edge is informational: it shows Conditional Access coverage, which is central to identifying gaps (principals no policy governs) and to reasoning about whether a control such as MFA actually reaches a given identity. It is not an exploitable permission on its own.

## Identification

### PowerShell (Microsoft Graph)

```powershell
Connect-MgGraph -Scopes "Policy.Read.All","Directory.Read.All"

Get-MgIdentityConditionalAccessPolicy -All |
  Select-Object DisplayName, State,
    @{N='IncludeUsers';E={$_.Conditions.Users.IncludeUsers -join ', '}},
    @{N='IncludeGroups';E={$_.Conditions.Users.IncludeGroups -join ', '}},
    @{N='IncludeRoles';E={$_.Conditions.Users.IncludeRoles -join ', '}} |
  Format-Table -AutoSize
```

### Azure Portal

1. Open **Microsoft Entra admin center** -> **Protection** -> **Conditional Access** -> **Policies**.
2. Open a policy -> **Assignments** -> **Users** to see the included users, groups, and roles it applies to.

## Exploitation

There is no direct exploit for this edge; it records which principals a Conditional Access Policy governs. It is used to find coverage gaps and to confirm whether protections apply to a given identity. See [AZ\_CAP\_EXCLUDES](https://docs.forestall.io/fsprotect/edges/azure/az_cap_excludes) for exclusions that can create silent gaps, and [AZ\_CAP\_PROTECTS](https://docs.forestall.io/fsprotect/edges/azure/az_cap_protects) for the resources side.

## Mitigation

* Ensure critical protections (admin MFA, all-user MFA) apply to the intended principals with no unintended narrowing.
* Prefer group-based assignment with tightly controlled membership over ad-hoc individual assignment.
* Review policies whose include targets are `All` together with their exclusions to confirm real coverage.

## Detection

Use the Microsoft Entra admin center:

1. Open **Microsoft Entra ID** -> **Audit logs** and filter for Conditional Access policy changes.
2. Review **Initiated by (actor)**, **Target** (the policy), **Date**, and **Status** for unexpected assignment changes.
3. Use **Conditional Access** -> **Insights and reporting** to confirm which identities are actually in scope.

## References

* <https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-users-groups>
* <https://learn.microsoft.com/en-us/graph/api/resources/conditionalaccesspolicy>
* <https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview>