AZ_CAP_EXCLUDES

Copy page

Summary


Forestall ACL Alias	AZ_CAP_EXCLUDES
Entra ID (Azure AD) Alias	Conditional Access Policy - Exclusions
Affected Object Types	Conditional Access Policy -> Users, Groups, Service Principals, Applications
Edge Direction	AZConditionalAccessPolicy -> Principal / Application
Exploitation Certainty	Informational

Description

AZ_CAP_EXCLUDES connects a Conditional Access Policy (AZConditionalAccessPolicy) to the principals and cloud apps it excludes from enforcement. Exclusions come from the policy’s exclude assignments: excluded users (including the All and GuestsOrExternalUsers sentinels expanded to concrete users), excluded groups, excluded roles (expanded to the users, groups, and service principals that hold them), and excluded applications and service principals.

This edge is informational, but exclusions are the single most common source of silent Conditional Access gaps: a principal or app that is excluded from a policy is not protected by it, even though the policy otherwise appears to apply. An exclusion whose members cancel out the policy’s include targets can leave a policy protecting nobody. Break-glass accounts are legitimately excluded from most policies; unexpected exclusions are a finding.

The companion edges are AZ_CAP_APPLIES_TO (governed principals) and AZ_CAP_PROTECTS (covered apps).

Identification

PowerShell (Microsoft Graph)

Connect-MgGraph -Scopes "Policy.Read.All","Directory.Read.All"

Get-MgIdentityConditionalAccessPolicy -All |
  Select-Object DisplayName, State,
    @{N='ExcludeUsers';E={$_.Conditions.Users.ExcludeUsers -join ', '}},
    @{N='ExcludeGroups';E={$_.Conditions.Users.ExcludeGroups -join ', '}},
    @{N='ExcludeRoles';E={$_.Conditions.Users.ExcludeRoles -join ', '}},
    @{N='ExcludeApps';E={$_.Conditions.Applications.ExcludeApplications -join ', '}} |
  Format-Table -AutoSize

Exploitation

There is no direct exploit for this edge; it records what a policy excludes. Its security value is defensive: it exposes principals and apps that a policy does not protect. An attacker who compromises an excluded identity (for example an over-broad break-glass group, or a service account excluded “temporarily”) bypasses the control the policy was meant to enforce. Review exclusions to find and close silent gaps.

Mitigation

Keep exclusions minimal and documented; prefer excluding a small, tightly controlled break-glass group over broad exclusions.
Confirm that an exclusion group’s membership is exactly the intended accounts.
Watch for policies whose exclusions cancel their own include targets, which protect nobody.
Re-review temporary exclusions on a schedule and remove them when no longer needed.

Detection

Use the Microsoft Entra admin center:

Open Microsoft Entra ID -> Audit logs and filter for Conditional Access policy changes and changes to any exclusion group’s membership.
Review Initiated by (actor), Target, Date, and Status for unexpected exclusion changes.
Use Conditional Access -> Insights and reporting to confirm which identities fall outside enforcement.

Ask AI