Find User or Group From 32 Character ID in CAP Change

Question

There was a change to our conditional access policy. There's an additional 32 character ID in excluded locations. How can I use that alpha numeric ID to find what that is in plain English? I searched for it under named locations and had 0 results.

Answer 1

Helllo MZ,

Thanks for your question.

You are probably referring to a GUID. This could represent a user, group or SP.
I would recommend you attempt to find the ID using:

Get-MgUser

Get-MgGroup

Get-MGServiceprincipal

Let me know if that helps you locate the objects

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Abiola

Answer 2

Hi MZ,

The excludeLocations refers to Named Locations and each Named Location has a GUID identifier in the backend, but this isn't exposed in the GUI.

Looks like you have tried to locate the location GUID in Entra portal and that doesn't display it directly in Entra.

Hence, go to [Graph-https://developer.microsoft.com/en-us/graph/graph-explorer) and run query below if you find the guid and its display name of the excluded location.

GET https://graph.microsoft.com/v1.0/identity/conditionalAccess/namedLocations

I too have one GUID under excluded Locations. Hence, I tried in graph explorer and found one that is associated DisaplayName

![User's image] (https://learn-attachment.microsoft.com/api/attachments/3c546aff-69eb-40de-9b5c-03269f71883c?platform=QnA)

        {

            "@odata.type": "#microsoft.graph.ipNamedLocation",

            "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxx",

            "displayName": "Teams Workers",

            "modifiedDateTime": "2024-09-24T19:30:31.8158212Z",

            "createdDateTime": "2024-09-24T19:30:31.8158212Z",

            "isTrusted": true,

            "ipRanges": [

                {

                    "@odata.type": "#microsoft.graph.iPv4CidrRange",

                    "cidrAddress": "172.174.xx.xxx/32"

                }

            ]

        }

To retrieve the Conditional access policies (CAPs) and see the actual exclude Locations, you run below query

GET https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies

If this answers your query, do click Accept Answer and Yes for was this answer helpful, which may help members with similar questions.

If you have any other questions or are still experiencing issues, feel free to ask in the "comments" section, and I'd be happy to help.