Share via

MS Graph Endpoint /v1.0/identity/conditionalAccess/policies not listing all policies

Ville Koch 40 Reputation points
2023-01-25T06:04:37.1966667+00:00

I'm trying to enumerate all conditional access policies via the MS Graph endpoint

[https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies

Unfortunately, this only returns one entry, even though there are more:


PS C:\> $capurl = "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies"
PS C:\> $capolicies = Invoke-RestMethod -Method Get -UseBasicParsing -Uri "$capURL" -Headers $Headers
PS C:\> $capolicies.value


id               : b2068eb2-e213-43a3-8462-14cf15766450
displayName      : cap-block-foreign-logins
createdDateTime  : 2023-01-23T12:13:55.7574472Z
modifiedDateTime :
state            : enabledForReportingButNotEnforced
sessionControls  :
conditions       : @{userRiskLevels=System.Object[]; signInRiskLevels=System.Object[]; clientAppTypes=System.Object[]; servicePrincipalRiskLevels=System.Object[];
                   platforms=; devices=; clientApplications=; applications=; users=; locations=}
grantControls    : @{operator=OR; builtInControls=System.Object[]; customAuthenticationFactors=System.Object[]; termsOfUse=System.Object[]}

In the portal, I can see the following three policies:

User's image

It doesn't matter if I try this with a Global Admin or e.g. Security Reader assigned user...

Even if I filter for the actual displayName of one of the other policies, they are not returned:

PS C:\> $capURL ="https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies?`$filter=displayName eq 'cap-test'"
PS C:\> $capolicies = Invoke-RestMethod -Method Get -UseBasicParsing -Uri "$capURL" -Headers $Headers
PS C:\> $capolicies.value
[ EMPTY RESULT HERE???]
PS C:\> $capURL ="https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies?`$filter=displayName eq 'cap-block-foreign-logins'"
PS C:\> $capolicies = Invoke-RestMethod -Method Get -UseBasicParsing -Uri "$capURL" -Headers $Headers
PS C:\> $capolicies.value


id               : b2068eb2-e213-43a3-8462-14cf15766450
displayName      : cap-block-foreign-logins
createdDateTime  : 2023-01-23T12:13:55.7574472Z
modifiedDateTime :
state            : enabledForReportingButNotEnforced
sessionControls  :
conditions       : @{userRiskLevels=System.Object[]; signInRiskLevels=System.Object[]; clientAppTypes=System.Object[]; servicePrincipalRiskLevels=System.Object[];
                   platforms=; devices=; clientApplications=; applications=; users=; locations=}
grantControls    : @{operator=OR; builtInControls=System.Object[]; customAuthenticationFactors=System.Object[]; termsOfUse=System.Object[]}

I saw that other people already asked the same question but no solution was ever provided... Do I have to open a GitHub issue for this?

Microsoft Security | Microsoft Graph
0 comments No comments

Answer accepted by question author

Vasil Michev 126.8K Reputation points MVP Volunteer Moderator
2023-01-25T07:49:17.13+00:00

One possible reason is that your policies are using conditions/actions not currently supported in /v1.0, such as the "Guests or external users" condition. Switching to using the /beta endpoint should cover these.

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.