<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Conditional Access Policies — API Reference

## Microsoft Graph API

```bash
# List all policies
GET https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies

# Get specific policy
GET https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies/{id}

# Create policy
POST https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies

# Update policy
PATCH https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies/{id}

# Delete policy
DELETE https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies/{id}

# Named locations
GET https://graph.microsoft.com/v1.0/identity/conditionalAccess/namedLocations
```

## Azure CLI Commands

```bash
# List CA policies
az rest --method GET --url "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies"

# Export for backup
az rest --method GET --url "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" --output-file ca_backup.json

# Sign-in logs with CA results
az rest --method GET --url "https://graph.microsoft.com/v1.0/auditLogs/signIns?\$top=10&\$select=userPrincipalName,conditionalAccessStatus,appliedConditionalAccessPolicies"
```

## Policy Schema Reference

```json
{
  "displayName": "Policy Name",
  "state": "enabled | disabled | enabledForReportingButNotEnforced",
  "conditions": {
    "users": {
      "includeUsers": ["All | user-id"],
      "excludeUsers": ["break-glass-id"],
      "includeGroups": ["group-id"],
      "excludeGroups": ["group-id"]
    },
    "applications": {
      "includeApplications": ["All | app-id"],
      "excludeApplications": ["app-id"]
    },
    "clientAppTypes": ["all | browser | mobileAppsAndDesktopClients | exchangeActiveSync | other"],
    "locations": {
      "includeLocations": ["All | AllTrusted | location-id"],
      "excludeLocations": ["AllTrusted | location-id"]
    },
    "signInRiskLevels": ["high", "medium"],
    "userRiskLevels": ["high", "medium"],
    "platforms": {
      "includePlatforms": ["all | android | iOS | windows | macOS | linux"]
    }
  },
  "grantControls": {
    "operator": "OR | AND",
    "builtInControls": ["block | mfa | compliantDevice | domainJoinedDevice | passwordChange"]
  },
  "sessionControls": {
    "signInFrequency": {"value": 1, "type": "hours"},
    "persistentBrowser": {"mode": "never"}
  }
}
```

## Key Audit Checks

| Check | API Field | Expected Value |
|-------|-----------|----------------|
| Legacy auth blocked | clientAppTypes contains exchangeActiveSync | block control |
| MFA for all | includeUsers=All + mfa control | Enabled |
| Break-glass excluded | excludeUsers | ≤2 accounts |
| All apps covered | includeApplications=All | Enabled |
| Risk-based blocking | signInRiskLevels | high, medium |
| Report-only tested | state | Report-only before enabled |
