How to find Conditional Access policies not enforced in Entra ID

Before you start

Use an account in one of these roles: Security Reader, Global Reader, Security Administrator or Conditional Access Administrator. Conditional Access needs Microsoft Entra ID P1. The PowerShell example requests Policy.Read.All; your organisation may require administrator consent.

The list is the policies as they are now. What a report-only policy would have done is in the sign-in logs, on the Report-only tab of each sign-in. The examples read and export; they don't turn any policy on or off.

Option 1

Find Conditional Access policies not enforced with PowerShell

Install the modules once, then connect and export every policy that is not on. The script reads every policy and keeps those whose state is not enabled.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'Policy.Read.All' -NoWelcome
try {
    $policies = @(Get-MgIdentityConditionalAccessPolicy -All)
    $report = @($policies | Where-Object { $_.State -ne 'enabled' } |
        Sort-Object State, DisplayName | ForEach-Object {
            $users = $_.Conditions.Users
            [pscustomobject]@{
                Policy        = $_.DisplayName
                State         = $_.State
                IncludeUsers  = @($users.IncludeUsers) -join '; '
                IncludeGroups = @($users.IncludeGroups) -join '; '
                IncludeRoles  = @($users.IncludeRoles) -join '; '
                Applications  = @($_.Conditions.Applications.IncludeApplications) -join '; '
                Grant         = @($_.GrantControls.BuiltInControls) -join '; '
                Modified      = $_.ModifiedDateTime
                Id            = $_.Id
            }
        })
    if ($report.Count -eq 0) {
        Write-Output "All $($policies.Count) Conditional Access policies are on."
    } else {
        $report |
            Export-Csv -Path './ca-policies-not-enforced.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) of $($policies.Count) policies are report-only or off."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The CSV lists the off policies first, then the report-only ones, each with the users, groups and roles it includes, the applications it covers and what it grants. Users, groups and roles are IDs, apart from All, None and GuestsOrExternalUsers. Modified is when the policy last changed, so a policy left in report-only for months stands out. To list the report-only policies alone, change the test to $_.State -eq 'enabledForReportingButNotEnforced'.

Option 2

Check policy states in the admin centre

1. Sign in to the Microsoft Entra admin centre for the correct tenant.
2. Go to Entra ID > Conditional Access > Policies. Policies Microsoft manages show Microsoft in the Created by column.
3. Use the filter options at the top of the list to narrow it, then select a policy and read Enable policy: Report-only or Off means it is not enforced.
4. Leave the policy without saving. It opens in its editor, so change nothing.
5. To see what a report-only policy would have done, go to Entra ID > Monitoring & health > Sign-in logs, open a sign-in and read its Report-only tab.

This suits checking 1 policy before you turn it on. Each policy opens on its own, so for a list of every policy not enforced, with when each last changed, use PowerShell or a report.

Common questions

Why is there a report-only policy nobody here created?

Microsoft creates its managed policies in a tenant in report-only. If they are left that way, Microsoft turns them on no less than 30 days after they arrive, and sends an email and a Message center post 2 weeks before. Turn one on sooner, or set it to Off to opt out.

Can a report-only policy affect anyone?

It doesn't ask for MFA or block access. Microsoft notes 2 exceptions: a report-only policy that requires a compliant device can prompt people on macOS, iOS and Android to choose a device certificate, and one that uses GPS-based named locations asks people to share their location.

How do I export every policy, not just these?

Read them all with the same cmdlet and keep every setting. See how to export Conditional Access policies.