Created by Claude - please verify

Authentication contexts - defined contexts, the CA policies that target them and the PIM role settings that require them.

Required Microsoft Graph permissions

Policy.Read.ConditionalAccess RoleManagementPolicy.Read.Directory (PIM references) — application permissions, granted to the app registration with admin consent.

Licence: Microsoft Entra ID P1 (P2 for the PIM references).

Endpoints: GET /v1.0/identity/conditionalAccess/authenticationContextClassReferences · GET /v1.0/identity/conditionalAccess/policies · GET /v1.0/policies/roleManagementPolicyAssignments?$expand=policy($expand=rules)

Sensitivity labels and protected actions can also require a context; they are not read here, so a published context with no enforcing policy is flagged in any case.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Authentication Contexts - Are They Enforced?

An authentication context is a promise of step-up authentication: PIM, sensitivity labels and protected actions ask for it, and a Conditional Access policy is supposed to enforce it. If no enabled policy targets the context, whatever asks for it gets no step-up at all.