How to get conditional access policies using Microsoft Graph PowerShell

Conditional access policies control access to data and cloud apps by enforcing security requirements based on sign-in context. Using the Get-MgIdentityConditionalAccessPolicy cmdlet, you can retrieve, analyze, and review all conditional access policies in your Microsoft Entra tenant, supporting compliance and ongoing risk management.

This article shows you how to get conditional access policies using both the Microsoft Entra admin center and Microsoft Graph PowerShell:

Get conditional access policies using Microsoft Graph PowerShell

Prerequisites

You’ll need the Policy.Read.All or Policy.ReadWrite.ConditionalAccess permissions and Microsoft Graph PowerShell installed. Install and connect to Microsoft Graph PowerShell by running the script below:

Using the Get-MgIdentityConditionalAccessPolicy cmdlet

Simply run the cmdlet to list all condition access policies:

Examples

Example 1: Get details for a specific policy

Example 2: Get only the names and states of all policies

Supported parameters

The following essential parameters can be used along with the Get-MgIdentityConditionalAccessPolicy cmdlet:

Limitations of using native tools to get conditional access policies

• PowerShell commands can get complex with different use cases and scenarios.
• IT admins can spend a lot of time troubleshooting errors, which negatively impacts productivity.
• Delegation can get tricky since technicians require elevated permissions.