🎉 Our Microsoft 365 Reporting & Management Tool is available in Marketplace 🚀
Microsoft 365

How to Find MFA-Configured Conditional Access Policies in Microsoft 365

In modern workspaces, MFA requirement through Conditional Access plays a key role in protecting Microsoft identities and resources. But misconfigured policies can unintentionally block user access or expose vulnerabilities that attackers can exploit. This guide shows how to find MFA-configured Conditional Access policies for effective troubleshooting and precise compliance management.

Microsoft 365 tools
Solution 1
Solution 2
Solution 3
Important Tips
Errors and Resolution Steps

Identify MFA-Enabled CA Policies Using Entra Admin Center

Microsoft 365 Permission Required
Security Reader Least Privilege
Global Administrator Most Privilege
  • Sign in to the Microsoft Entra admin center.
  • Navigate to the Conditional Access section under the Entra ID drop-down.
  • In Conditional Access page, switch to the Policies tab and click on Add filter.
  • Select the Grant Control filter with Require multifactor authentication checkbox and apply the filter.
  • This lists the Conditional Access policies that require MFA with details such as policy name, created by, state, creation date, and modified date.
Identify MFA-Enabled CA Policies Using Entra Admin Center

Get MFA-Configured CA Policies Using PowerShell

Microsoft 365 Permission Required
Policy.Read.All Least Privilege
Directory.ReadWrite.All Most Privilege
  • Connect to the Microsoft Graph PowerShell module with required permissions using the cmdlet below.
  • Windows PowerShell Windows PowerShell 
     Connect-MgGraph -Scopes "Policy.Read.All"
  • Run the following cmdlet to find the Conditional Access policies that require multifactor authentication in Microsoft 365.
  • Windows PowerShell Windows PowerShell 
     Get-MgIdentityConditionalAccessPolicy |
    Where-Object { $_.GrantControls.BuiltInControls -contains "mfa" } |
    Select-Object `
        CreatedDateTime, 
        Id, 
        DisplayName,
        State,
        @{Name = "GrantControls"; Expression = { ($_.GrantControls.BuiltInControls -join ",").ToUpper() }},
        TemplateId |
    Format-Table -AutoSize
Get MFA-Configured CA Policies Using PowerShell

The MFA-configured Conditional Access policies report provides the details, such as created date & time, policy id, display name, state, grant controls, and template ID.

Gain Deeper Visibility into MFA-Based Conditional Access Policies with Unified Reporting

AdminDroid’s Entra ID Analytics tool offers powerful insights on CA policy assignments and configurations along with visibility into risky sign-ins, device usage patterns, and access trends across your Microsoft 365. With these insights, admins find the right balance between security and accessibility to safeguard identities as well as resources.

Track MFA Adoption Trends with Overview Dashboard

Monitor the MFA overview dashboard to find registered methods, analyze usage trends for privileged roles, and verify accurate MFA enforcement through Conditional Access policies.

Get Notified on Conditional Access Failed Sign-ins in Microsoft 365

Leverage the default alert policy template to report unusual volume of sign-ins blocked by Conditional Access and monitor the risky sign-ins.

Export Conditional Access Policies in Microsoft 365

View the Conditional Access policies report to track all active & report-only policies and verify applied conditions to ensure secured access control in your M365 organization.

Audit Included and Excluded Conditions for MFA based Conditional Access Policies

Check the detailed assignments for MFA enabled CA policies report to identify condition-wise targeting of users, roles, locations, etc., to ensure risk mitigation.

Find User Sign-ins Enforced with MFA Using Conditional Access Policies

Identify sign-ins configured through CA policies to track users challenged for MFA based on policy enforcement and validate secure sign-in flows.

Notify Admins About Pending MFA Enrollments Using the Pre-built Reminder Agent

Use built-in Pending MFA Activation Reminder agent to notify admins on users who haven’t enrolled for MFA to enable effective Conditional Access enforcement.

Overall, AdminDroid empowers admins with advanced capabilities to proactively monitor MFA-configured Conditional Access policies and analyze their assignments effectively. The actionable insights on sign-in prompts, enforcement sources, authentication methods, etc., enables precise tracking and strategic oversight of Microsoft 365 security policies.

Important tips

Use CA insights & reporting workbook to evaluate MFA and Conditional Access behavior on users to fine-tune policy impact on sign-ins.

Configure remember multi-factor authentication setting in Microsoft 365 to reduce repeated prompts on trusted devices for secured and seamless access.

Set up break glass accounts in Entra admin center with phishing-resistant MFA methods to ensure reliable admin access during lockouts.

Common Errors and Resolution Steps

Here are the possible errors and troubleshooting fixes while handling MFA-configured Conditional Access policies.

Error Get-MgIdentityConditionalAccessPolicy : Your account does not have access to this report or data. Status: 403 (Forbidden)

This error occurs when the Get-MgIdentityConditionalAccessPolicy cmdlet is executed with a user account that lacks the necessary privilege role.

Fix Connect to Microsoft Graph PowerShell with one of these privileged roles such as Security Reader, Company Administrator, Security Administrator, Conditional Access Administrator, Global Reader, Devices Administrator, or Entra Network Access Administrator.

Error Get-MgIdentityConditionalAccessPolicy : Authentication needed. Please call Connect-MgGraph.

This error occurs when the connection between Microsoft Graph and the PowerShell Session is not established while executing the cmdlet.

Fix Connect to the Microsoft Graph PowerShell module with the required permissions as shown below. 
Connect-MgGraph -Scopes "Policy.Read.All", "Directory.Read.All"

Error Get-MgIdentityConditionalAccessPolicy : The term 'Get-MgIdentityConditionalAccessPolicy' is not recognized as the name of a cmdlet, function, script file, or operable program.

This error occurs because the required modules are not properly updated/installed in PowerShell.

Fix Perform the update or reinstall of Microsoft Graph Identity SignIns submodule to ensure proper cmdlet functionality with PowerShell.
#To update the Microsoft Graph module.
Update-Module Microsoft.Graph.Identity.SignIns -Force


#To reinstall the Microsoft Graph PowerShell module.
Uninstall-Module Microsoft.Graph.Identity.SignIns -Force
Install-Module Microsoft.Graph.Identity.SignIns

Error Don't lock yourself out! This policy will affect all of your users. We recommend applying a policy to a small set of users first to verify it behaves as expected.

This error occurs when you try to create a Conditional Access policy with the All Users condition.

Fix Exclude break glass accounts before creating the Conditional Access policy to resolve this issue.

Error Get-MgIdentityConditionalAccessPolicy_List : Could not load type 'Microsoft.Graph.Authentication.AzureIdentityAccessTokenProvider' from assembly 'Microsoft.Graph.Core’.

This error pops up when the Get-MgIdentityConditionalAccessPolicy is executed in PowerShell 7 or later versions.

Fix Run the cmdlet using Windows PowerShell (5.1), which offers better compatibility with Microsoft Graph’s authentication module than PowerShell 7+.

Kickstart Your Journey With
AdminDroid

Your Microsoft 365 Companion with Enormous Reporting Capabilities

Download Now
Browse All Guides
User Help Manuals Compliance Docs Customer Stories
All Guides 99+
Microsoft 365
Identify CA Policies with MFA in M365
Microsoft 365 Guides