Created by Claude - please verify

Authentication strengths - allowed method combinations per strength, joined with the CA policies that use them.

Required Microsoft Graph permissions

Policy.Read.All — application permission, granted to the app registration with admin consent.

Licence: Microsoft Entra ID P1.

Endpoints: GET /v1.0/policies/authenticationMethodsPolicy/authenticationStrengthPolicies · GET /v1.0/identity/conditionalAccess/policies (cached)

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Authentication Strengths - What They Really Allow

Conditional Access policies that require an authentication strength are only as strong as the combinations the strength allows. A custom strength called "Phishing-resistant MFA" that also accepts SMS, push or OATH codes quietly downgrades every policy that uses it. The Policy Analyzer shows the strength's name only.