Created by Claude - please verify

Conditional Access coverage - a static reading of the policies, not a sign-in simulation. Use the What-If Checker to confirm a single case.

Required Microsoft Graph permissions

Policy.Read.All User.Read.All Group.Read.All RoleManagement.Read.Directory — application permissions, granted to the app registration with admin consent.

Licence: Microsoft Entra ID P1 (Conditional Access).

Endpoints: GET /v1.0/identity/conditionalAccess/policies · GET /v1.0/groups/{id}/transitiveMembers · GET /v1.0/users · GET /v1.0/roleManagement/directory/roleAssignments

'Covered' means an enforced policy requires MFA (or blocks) for all cloud apps and all client apps with no location, platform or risk condition, and MFA cannot be swapped for another control. Security defaults, per-user MFA and authentication context are not evaluated.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Conditional Access Coverage Gaps

Which enabled accounts no MFA policy actually covers, and which policies leave holes: report-only mode, "MFA or compliant device", location exclusions, or large exclusion groups.

No enabled user accounts were returned. Please contact support if this is not the expected result.