Get-EntraConditionalAccessPolicy

Module:

Microsoft.Entra.SignIns Module v1.3

Gets a Microsoft Entra ID conditional access policy.

Get-EntraConditionalAccessPolicy

 [-Property <String[]>]
 [<CommonParameters>]

Get-EntraConditionalAccessPolicy

 -PolicyId <String>
 [-Property <String[]>]
 [<CommonParameters>]

This cmdlet allows an admin to get the Microsoft Entra ID conditional access policy. Conditional access policies are custom rules that define an access scenario.

In delegated scenarios involving work or school accounts, the signed-in user must have a Microsoft Entra role or a custom role with the required permissions to act on behalf of another user. The following least privileged roles support this operation:

• Global Secure Access Administrator (read standard properties)
• Security Reader (read standard properties)
• Security Administrator (read standard properties)
• Global Reader
• Conditional Access Administrator

In delegated scenarios involving work or school accounts, the signed-in user must have a Microsoft Entra role or a custom role with the required permissions to act on behalf of another user. The following least privileged roles support this operation:

• Global Secure Access Administrator (read standard properties)
• Security Reader (read standard properties)
• Security Administrator (read standard properties)
• Global Reader
• Conditional Access Administrator

Connect-Entra -Scopes 'Policy.Read.All'
Get-EntraConditionalAccessPolicy

Id CreatedDateTime Description DisplayName ModifiedDateTime State TemplateId
-- --------------- ----------- ----------- ---------------- ----- ----------
eeeeeeee-4444-5555-6666-ffffffffffff 2/27/2024 6:23:21 AM ConditionalAccessPolicy 2/29/2024 2:41:17 PM disabled
ffffffff-5555-6666-7777-aaaaaaaaaaaa 2/27/2024 6:26:00 AM ConditionalAccessPolicy 2/29/2024 2:41:34 PM disabled
aaaaaaaa-6666-7777-8888-bbbbbbbbbbbb 2/27/2024 6:30:48 AM ConditionalAccessPolicy 2/29/2024 2:43:53 PM disabled

This example retrieves a list of all conditional access policies in Microsoft Entra ID.

Connect-Entra -Scopes 'Policy.Read.All'
$policy = Get-EntraConditionalAccessPolicy | Where-Object { $_.DisplayName -eq 'Multifactor authentication for Contoso partners and vendors' }
Get-EntraConditionalAccessPolicy -PolicyId $policy.Id

Id CreatedDateTime Description DisplayName ModifiedDateTime State TemplateId
-- --------------- ----------- ----------- ---------------- ----- ----------
eeeeeeee-4444-5555-6666-ffffffffffff 2/27/2024 6:23:21 AM Multifactor authentication 2/29/2024 2:41:17 PM disabled

This example retrieves a specified conditional access policy in Microsoft Entra ID.

• -PolicyId parameter specifies the Id of a conditional access policy.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.