How to update conditional access policies using Microsoft Graph PowerShell

The Update-MgIdentityConditionalAccessPolicy cmdlet modifies the settings of an existing conditional access policy in Microsoft Entra ID. Conditional access policies define the rules that govern how users and devices can access organizational resources, such as requiring MFA and restricting access from specific locations. With this cmdlet, admins can update policy conditions, grant or block controls, and session settings as business needs evolve.

This article shows you how to update conditional access policies using both the Microsoft Entra admin center and Microsoft Graph PowerShell:

Update conditional access policies using Microsoft Graph PowerShell

Prerequisites

• Ensure you have the Policy.ReadWrite.ConditionalAccess permission assigned.
• Install and connect to Microsoft Graph PowerShell by running the script below:
  Copy Install-Module Microsoft.Graph -Scope CurrentUser Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess"

Using the Update-MgIdentityConditionalAccessPolicy cmdlet

Run the script below by adding the policy's ID to modify the properties:

Examples

Example 1: Enable a conditional access policy

Example 2: Update policy to require MFA only for selected group

Example 3: Disable a policy temporarily

Supported parameters

The following essential parameters can be used along with the Update-MgIdentityConditionalAccessPolicy cmdlet.

Limitations of using native tools to update conditional access policies

Although powerful, relying solely on Microsoft Graph PowerShell and Entra ID admin centre can present challenges:

• PowerShell commands can get complex with different use cases and scenarios.
• IT admins can spend a lot of time troubleshooting errors, which negatively impacts productivity.
• Delegation can get tricky since technicians require elevated permissions.