EntraCaExclusionReport

Author(s)

• Olamide Olaleye

Tags

Entra EntraID AzureAD ConditionalAccess Security Audit MicrosoftGraph Compliance PSGallery

Functions

Get-EntraCaExclusionReport

PSEditions

Core

Dependencies

This module has no dependencies.

Release Notes

Initial public release.

Get-EntraCaExclusionReport enumerates every Conditional Access policy in an Entra ID tenant and exports one CSV row per excluded user or group principal per policy, so every deliberate exclusion from a Conditional Access control is visible and attributable.

- Strictly read-only against the directory. No create, update or delete against any Entra ID object; the only write is the CSV.
- Group membership is never enumerated or expanded. Group exclusions are reported by ObjectID and DisplayName only.
- Unresolved principals are never dropped. The raw identifier is preserved with a marked unresolved display name.
- Per-policy error isolation. A failure on one policy does not abort the run or truncate the report.
- A policy with no exclusions still produces one row, so the CSV is a complete assessment rather than a partial extract.
- Six-column CSV: PolicyName, State, ObjectID, UserPrincipalName, DisplayName, PrincipalType.
- Optional -IncludeExcludedRoles adds excluded directory roles and guest/external user types.
- Device code sign-in by default, or -UseExistingConnection to reuse a Graph session.

Requires PowerShell 7.0+ and the Microsoft Graph SDK (checked at runtime, not declared as RequiredModules so importing the module stays fast).