en-US/about_EntraCaExclusionReport.help.txt
|
TOPIC about_EntraCaExclusionReport SHORT DESCRIPTION Audit reporting for Microsoft Entra ID Conditional Access exclusions. LONG DESCRIPTION Every principal excluded from a Conditional Access policy is a deliberate hole in a security control. EntraCaExclusionReport enumerates every Conditional Access policy in a tenant and emits one CSV row per excluded principal per policy, so that each of those holes is visible and attributable in a single artefact. The module is strictly read-only against the directory. It performs no create, update, or delete against any Entra ID object; its only write is the CSV file it produces. A policy with no exclusions still produces exactly one row. The CSV is therefore a complete assessment of every policy in scope, not a partial extract of only the policies that happen to have exclusions - a distinction that matters when the output is used as audit evidence, because an absent row must never be readable as "assessed and clean". COMMANDS Get-EntraCaExclusionReport Connects to Microsoft Graph, assesses every Conditional Access policy in scope, and writes the exclusion report to CSV. Run Get-Help Get-EntraCaExclusionReport -Full for parameters and examples. OUTPUT SCHEMA The CSV carries six columns, in this order: PolicyName The Conditional Access policy display name. State The mapped policy state: On, Off, or Report-Only. ObjectID The excluded principal's object identifier, or a reserved token. UserPrincipalName The UPN for excluded users; a marker for other principal types. DisplayName The resolved display name, or a marked unresolved value. PrincipalType One of User, Group, Role, Token, None, or Error. PrincipalType exists so a consumer can filter or pivot by principal type directly rather than inferring it from a UserPrincipalName marker. DESIGN CONSTRAINTS Group membership is never enumerated. Group exclusions are reported by ObjectID and DisplayName only. Expanding a group to its member users would turn a read of policy configuration into a read of the directory's membership graph, which this module deliberately does not do. Unresolved principals are never dropped. A principal that cannot be resolved is reported with its raw identifier preserved and a marked unresolved display name. Silently omitting it would produce false assurance in the report. Errors are isolated per policy. A failure assessing one policy does not abort the run or remove the remaining policies from the report. Output is deterministic. Rows are sorted so that two runs over an unchanged tenant produce comparable files. REQUIRED GRAPH SCOPES Policy.Read.All Read Conditional Access policy definitions. Always. User.Read.All Resolve excluded user IDs. Always. Group.Read.All Resolve excluded group IDs. Always. Membership is never read under this or any scope. RoleManagement.Read.Directory Resolve excluded directory role IDs. Requested only when -IncludeExcludedRoles is specified. All are read-only delegated scopes. In a tenant with user consent restricted, an administrator must consent to them for the Microsoft Graph PowerShell SDK enterprise application before a standard user can run the report. DEPENDENCIES The Microsoft Graph SDK sub-modules are deliberately not declared as RequiredModules in the manifest: they are large and slow to import, and declaring them would force every one of them to load on Import-Module, including for -Help or tab completion. The module performs its own runtime availability check and fails with an actionable Install-Module instruction. Required at runtime: Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns, Microsoft.Graph.Users, Microsoft.Graph.Groups, and - only under -IncludeExcludedRoles - Microsoft.Graph.Identity.DirectoryManagement. SEE ALSO Get-EntraCaExclusionReport https://learn.microsoft.com/entra/identity/conditional-access/ |