> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/edges/azure/az_cap_protects.md).

# AZ\_CAP\_PROTECTS

## Summary

|                               |                                                               |
| ----------------------------- | ------------------------------------------------------------- |
| **Forestall ACL Alias**       | AZ\_CAP\_PROTECTS                                             |
| **Entra ID (Azure AD) Alias** | Conditional Access Policy - Target Cloud Apps                 |
| **Affected Object Types**     | Conditional Access Policy -> Applications, Service Principals |
| **Edge Direction**            | AZConditionalAccessPolicy -> Application / Service Principal  |
| **Exploitation Certainty**    | Informational                                                 |

## Description

`AZ_CAP_PROTECTS` connects a **Conditional Access Policy** (`AZConditionalAccessPolicy`) to the **cloud apps it covers** - the applications and service principals in the policy's included target resources. A policy governs principals (see [AZ\_CAP\_APPLIES\_TO](https://docs.forestall.io/fsprotect/edges/azure/az_cap_applies_to)) and separately covers resources; this edge answers the "which apps" question.

The target-resource edge is kept distinct from the principals edge on purpose. If both shared a single edge type they could only be told apart by the target's label, which breaks down for a service principal that both holds a directory role (reached as a governed principal) and is itself a targeted cloud app.

The collector resolves target apps carefully:

* **Enterprise apps and app registrations** are both searched, because Conditional Access names apps by client **AppId** while collected apps are keyed by object id, and first-party apps (Exchange Online, SharePoint Online, Teams) exist only as service principals.
* The **Office365** keyword expands to Microsoft's documented first-party app id list rather than by display-name matching.
* The **All** sentinel is recorded on the policy (it covers everything) rather than fanned out to every service principal.

This edge is informational; it shows which resources a policy protects, which is needed to find apps that no policy covers.

## Identification

### PowerShell (Microsoft Graph)

```powershell
Connect-MgGraph -Scopes "Policy.Read.All"

Get-MgIdentityConditionalAccessPolicy -All |
  Select-Object DisplayName, State,
    @{N='IncludeApps';E={$_.Conditions.Applications.IncludeApplications -join ', '}} |
  Format-Table -AutoSize
```

### Azure Portal

1. Open **Microsoft Entra admin center** -> **Protection** -> **Conditional Access** -> **Policies**.
2. Open a policy -> **Assignments** -> **Target resources** -> **Cloud apps** to see which apps it protects.

## Exploitation

There is no direct exploit for this edge; it records which cloud apps a Conditional Access Policy covers. It is used to find resources that no policy protects and to confirm that a control applies to a sensitive app. See [AZ\_CAP\_APPLIES\_TO](https://docs.forestall.io/fsprotect/edges/azure/az_cap_applies_to) for the principals side and [AZ\_CAP\_EXCLUDES](https://docs.forestall.io/fsprotect/edges/azure/az_cap_excludes) for exclusions.

## Mitigation

* Prefer policies targeting **All cloud apps** for baseline protections, with deliberate, documented exclusions.
* Confirm that high-value apps are covered by the intended controls.
* Review target resources together with grant controls so a policy is not protecting apps it applies no control to.

## Detection

Use the Microsoft Entra admin center:

1. Open **Microsoft Entra ID** -> **Audit logs** and filter for Conditional Access policy changes.
2. Review **Initiated by (actor)**, **Target** (the policy), **Date**, and **Status** for unexpected changes to target resources.
3. Use **Conditional Access** -> **Insights and reporting** to see which apps and sign-ins the policy affects.

## References

* <https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps>
* <https://learn.microsoft.com/en-us/graph/api/resources/conditionalaccesspolicy>
* <https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview>