Conditional Access Coverage Gaps

The question it answers: Which enabled accounts does no enforced Conditional Access MFA policy fully cover?

Which enabled accounts no MFA policy actually covers, and which policies leave holes: report-only mode, “MFA or compliant device”, location exclusions, or large exclusion groups.

Note

‘Covered’ means an enforced policy requires MFA (or blocks) for all cloud apps and all client apps with no location, platform or risk condition, and MFA cannot be swapped for another control. Security defaults, per-user MFA and authentication context are not evaluated.

At a glance

Where in the app	Entra ID › Conditional Access › Coverage Gaps
Workload	Entra ID
Kind	Table · dashboard tile
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P1 (Conditional Access).
Report id (API and MCP)	entra.security.ca-coverage-gaps
Tabs on its page	Conditional Access Policy Gaps

Columns

Column	Key	Type
User	DisplayName	Link
UPN	UserPrincipalName	Text
Coverage	CoverageState	Status
Admin	IsAdmin	YesNo
Covered by	FullCoverageString	Text
Only under conditions	PartialCoverageString	Text
Excluded from	ExcludedFromString	Text
User type	UserType	Text

Filters

Filter	Key (API)	On when the page opens
Only users who are not fully covered	gaps	Yes
Members only (hide guests)	members-only	No

What it needs

Licence: Microsoft Entra ID P1 (Conditional Access).

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Policy.Read.All	Microsoft Graph	Read your organization’s policies
User.Read.All	Microsoft Graph	Read all users’ full profiles
User-LifeCycleInfo.Read.All	Microsoft Graph	Read all users’ lifecycle information
Group.Read.All	Microsoft Graph	Read all groups
RoleManagement.Read.Directory	Microsoft Graph	Read all directory RBAC settings
AuditLog.Read.All	Microsoft Graph	Read all audit log data

Data sources it reads

• GET /v1.0/identity/conditionalAccess/policies
• GET /v1.0/groups/{id}/transitiveMembers
• GET /v1.0/users
• GET /v1.0/roleManagement/directory/roleAssignments
• GET /v1.0/reports/authenticationMethods/userRegistrationDetails (admin flag)

Through the API and MCP

GET /ir-api/v1/reports/entra.security.ca-coverage-gaps?size=100
GET /ir-api/v1/reports/entra.security.ca-coverage-gaps?filter=gaps

An AI assistant reads it with the MCP tool get_report and the id entra.security.ca-coverage-gaps. The client needs the Read grant for Entra ID. See Using the API.