How to find Conditional Access policies with no exclusions

Before you start

Use an account in one of these roles: Security Reader, Global Reader, Security Administrator or Conditional Access Administrator. Conditional Access needs Microsoft Entra ID P1. The PowerShell example requests Policy.Read.All; your organisation may require administrator consent.

Know what counts as an exclusion. The examples count any excluded user, group or role, so a policy that excludes the wrong account still passes: check that what each policy excludes is your emergency access accounts. They read and export; they don't change any policy.

Option 1

Find policies with no exclusions with PowerShell

Install the modules once, then connect and export every enabled policy for all users that excludes no one.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'Policy.Read.All' -NoWelcome
try {
    $policies = @(Get-MgIdentityConditionalAccessPolicy -All)
    $report = @($policies | Where-Object {
        $users = $_.Conditions.Users
        $excluded = $users.ExcludeUsers -or $users.ExcludeGroups -or $users.ExcludeRoles
        $_.State -eq 'enabled' -and @($users.IncludeUsers) -contains 'All' -and -not $excluded
    } | Sort-Object DisplayName | ForEach-Object {
        [pscustomobject]@{
            Policy       = $_.DisplayName
            Applications = @($_.Conditions.Applications.IncludeApplications) -join '; '
            Grant        = @($_.GrantControls.BuiltInControls) -join '; '
            Operator     = $_.GrantControls.Operator
            Modified     = $_.ModifiedDateTime
            Id           = $_.Id
        }
    })
    if ($report.Count -eq 0) {
        Write-Output "Every enabled policy for all users excludes someone."
    } else {
        $report | Export-Csv -Path './ca-no-exclusions.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) enabled policies for all users exclude no one."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The script keeps policies whose state is enabled and whose included users are All, then drops any with an excluded user, group or role. Grant lists the built-in controls, such as mfa or block, and Operator says whether all of them or 1 of them is required. To see every all-user policy with what it excludes, remove -and -not $excluded and add ExcludeUsers, ExcludeGroups and ExcludeRoles from Conditions.Users to the output.

Option 2

Check a policy's exclusions in the admin centre

1. Sign in to the Microsoft Entra admin centre for the correct tenant.
2. Go to Entra ID > Conditional Access > Policies and open a policy whose state is On.
3. Under Assignments, select Users. On the Include tab, All users means the policy covers everyone.
4. On the Exclude tab, read the users, groups and roles left out. If none are selected, the policy has no exclusions.
5. Leave the policy without saving.

This suits checking 1 policy before you change it. Each policy opens on its own, so to check every policy, use PowerShell or a report.

Common questions

Which accounts should every policy exclude?

Your emergency access accounts. Microsoft suggests putting them in a dedicated security group, excluding that group from every policy that blocks or restricts sign-in, and testing each quarter that they can still sign in.

Why is a Microsoft-managed policy on the list?

Microsoft-managed policies sit in the same list as your own, with Microsoft in the Created by column. You can change their state and the identities they exclude, so exclude your emergency access accounts from them too.

Is a policy with an exclusion always safe?

Only if it excludes the right accounts. The report and the script pass a policy that excludes any user, group or role, including a group that has since been deleted. To find those, see how to find Conditional Access policies with deleted objects.