> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/edges/azure/az_cap_excludes.md).

# AZ\_CAP\_EXCLUDES

## Summary

|                               |                                                                              |
| ----------------------------- | ---------------------------------------------------------------------------- |
| **Forestall ACL Alias**       | AZ\_CAP\_EXCLUDES                                                            |
| **Entra ID (Azure AD) Alias** | Conditional Access Policy - Exclusions                                       |
| **Affected Object Types**     | Conditional Access Policy -> Users, Groups, Service Principals, Applications |
| **Edge Direction**            | AZConditionalAccessPolicy -> Principal / Application                         |
| **Exploitation Certainty**    | Informational                                                                |

## Description

`AZ_CAP_EXCLUDES` connects a **Conditional Access Policy** (`AZConditionalAccessPolicy`) to the principals and cloud apps it **excludes** from enforcement. Exclusions come from the policy's exclude assignments: excluded users (including the `All` and `GuestsOrExternalUsers` sentinels expanded to concrete users), excluded groups, excluded roles (expanded to the users, groups, and service principals that hold them), and excluded applications and service principals.

This edge is informational, but exclusions are the single most common source of **silent Conditional Access gaps**: a principal or app that is excluded from a policy is not protected by it, even though the policy otherwise appears to apply. An exclusion whose members cancel out the policy's include targets can leave a policy protecting nobody. Break-glass accounts are legitimately excluded from most policies; unexpected exclusions are a finding.

The companion edges are [AZ\_CAP\_APPLIES\_TO](https://docs.forestall.io/fsprotect/edges/azure/az_cap_applies_to) (governed principals) and [AZ\_CAP\_PROTECTS](https://docs.forestall.io/fsprotect/edges/azure/az_cap_protects) (covered apps).

## Identification

### PowerShell (Microsoft Graph)

```powershell
Connect-MgGraph -Scopes "Policy.Read.All","Directory.Read.All"

Get-MgIdentityConditionalAccessPolicy -All |
  Select-Object DisplayName, State,
    @{N='ExcludeUsers';E={$_.Conditions.Users.ExcludeUsers -join ', '}},
    @{N='ExcludeGroups';E={$_.Conditions.Users.ExcludeGroups -join ', '}},
    @{N='ExcludeRoles';E={$_.Conditions.Users.ExcludeRoles -join ', '}},
    @{N='ExcludeApps';E={$_.Conditions.Applications.ExcludeApplications -join ', '}} |
  Format-Table -AutoSize
```

### Azure Portal

1. Open **Microsoft Entra admin center** -> **Protection** -> **Conditional Access** -> **Policies**.
2. Open a policy -> **Assignments** -> **Users** -> **Exclude**, and **Target resources** -> **Exclude**, to see every exclusion.

## Exploitation

There is no direct exploit for this edge; it records what a policy excludes. Its security value is defensive: it exposes principals and apps that a policy does not protect. An attacker who compromises an excluded identity (for example an over-broad break-glass group, or a service account excluded "temporarily") bypasses the control the policy was meant to enforce. Review exclusions to find and close silent gaps.

## Mitigation

* Keep exclusions minimal and documented; prefer excluding a small, tightly controlled break-glass group over broad exclusions.
* Confirm that an exclusion group's membership is exactly the intended accounts.
* Watch for policies whose exclusions cancel their own include targets, which protect nobody.
* Re-review temporary exclusions on a schedule and remove them when no longer needed.

## Detection

Use the Microsoft Entra admin center:

1. Open **Microsoft Entra ID** -> **Audit logs** and filter for Conditional Access policy changes and changes to any exclusion group's membership.
2. Review **Initiated by (actor)**, **Target**, **Date**, and **Status** for unexpected exclusion changes.
3. Use **Conditional Access** -> **Insights and reporting** to confirm which identities fall outside enforcement.

## References

* <https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-users-groups>
* <https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-admin-mfa>
* <https://learn.microsoft.com/en-us/graph/api/resources/conditionalaccesspolicy>