Conditional Access Policy Gaps

The question it answers: Which Conditional Access MFA or block policies leave holes - report-only, MFA as one option, narrowing conditions or large exclusions?

Every Conditional Access policy that requires MFA or blocks access, and what it leaves out: report-only mode, “MFA or another control”, not all cloud apps, location / platform / risk conditions, or many excluded users.

Note

‘Users excluded’ counts the excluded users plus the members of excluded groups. Security defaults, per-user MFA and authentication context are not evaluated.

At a glance

Where in the app	Entra ID › Conditional Access › Coverage Gaps
Shown as	a tab of Conditional Access Coverage Gaps
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P1 (Conditional Access).
Report id (API and MCP)	entra.security.ca-policy-gaps

Columns

Column	Key	Type
Policy	DisplayName	Link
State	State	Text
Result	Severity	Status
Findings	FindingsString	Text
Grant	Grant	Text
Users	Users	Text
Apps	Apps	Text
Conditions	Conditions	Text
Users excluded	ExcludedUserCount	Text

What it needs

Licence: Microsoft Entra ID P1 (Conditional Access).

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Policy.Read.All	Microsoft Graph	Read your organization’s policies
Group.Read.All	Microsoft Graph	Read all groups

Data sources it reads

• GET /v1.0/identity/conditionalAccess/policies
• GET /v1.0/groups/{id}/transitiveMembers

Through the API and MCP

GET /ir-api/v1/reports/entra.security.ca-policy-gaps?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.security.ca-policy-gaps. The client needs the Read grant for Entra ID. See Using the API.