AZ_CAP_PROTECTS

Summary

Forestall ACL Alias	AZ_CAP_PROTECTS
Entra ID (Azure AD) Alias	Conditional Access Policy - Target Cloud Apps
Affected Object Types	Conditional Access Policy -> Applications, Service Principals
Edge Direction	AZConditionalAccessPolicy -> Application / Service Principal
Exploitation Certainty	Informational

Description

AZ_CAP_PROTECTS connects a Conditional Access Policy (AZConditionalAccessPolicy) to the cloud apps it covers - the applications and service principals in the policy's included target resources. A policy governs principals (see AZ_CAP_APPLIES_TO) and separately covers resources; this edge answers the "which apps" question.

The target-resource edge is kept distinct from the principals edge on purpose. If both shared a single edge type they could only be told apart by the target's label, which breaks down for a service principal that both holds a directory role (reached as a governed principal) and is itself a targeted cloud app.

The collector resolves target apps carefully:

• Enterprise apps and app registrations are both searched, because Conditional Access names apps by client AppId while collected apps are keyed by object id, and first-party apps (Exchange Online, SharePoint Online, Teams) exist only as service principals.

• The Office365 keyword expands to Microsoft's documented first-party app id list rather than by display-name matching.

• The All sentinel is recorded on the policy (it covers everything) rather than fanned out to every service principal.

This edge is informational; it shows which resources a policy protects, which is needed to find apps that no policy covers.

Identification

PowerShell (Microsoft Graph)

Connect-MgGraph -Scopes "Policy.Read.All"

Get-MgIdentityConditionalAccessPolicy -All |
  Select-Object DisplayName, State,
    @{N='IncludeApps';E={$_.Conditions.Applications.IncludeApplications -join ', '}} |
  Format-Table -AutoSize

Azure Portal

1. Open Microsoft Entra admin center -> Protection -> Conditional Access -> Policies.

2. Open a policy -> Assignments -> Target resources -> Cloud apps to see which apps it protects.

Exploitation

There is no direct exploit for this edge; it records which cloud apps a Conditional Access Policy covers. It is used to find resources that no policy protects and to confirm that a control applies to a sensitive app. See AZ_CAP_APPLIES_TO for the principals side and AZ_CAP_EXCLUDES for exclusions.

Mitigation

• Prefer policies targeting All cloud apps for baseline protections, with deliberate, documented exclusions.

• Confirm that high-value apps are covered by the intended controls.

• Review target resources together with grant controls so a policy is not protecting apps it applies no control to.

Detection

Use the Microsoft Entra admin center:

1. Open Microsoft Entra ID -> Audit logs and filter for Conditional Access policy changes.

2. Review Initiated by (actor), Target (the policy), Date, and Status for unexpected changes to target resources.

3. Use Conditional Access -> Insights and reporting to see which apps and sign-ins the policy affects.

References

• https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps

• https://learn.microsoft.com/en-us/graph/api/resources/conditionalaccesspolicy

• https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview