Conditional Access Review skill - #224
Conversation
Review an exported set of Microsoft Entra Conditional Access policies for coverage gaps, missing break-glass exclusions, policy conflicts, and configuration hygiene. Recommendations only, never a live change.
There was a problem hiding this comment.
Pull request overview
Adds a new conditional-access-review submission to the skill gallery, focused on reviewing exported Microsoft Entra Conditional Access policy sets and producing recommendation-only findings (no live changes).
Changes:
- Introduces the agent-facing
SKILL.mdwith a structured review procedure (coverage matrix, break-glass checks, conflicts, hygiene) and guardrails. - Adds a human-facing
README.mddescribing what the skill checks, how to obtain an export, and key limitations. - Adds
metadata.jsonto register the submission (name/description/platforms/tags/author/version/dates).
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| submissions/conditional-access-review/SKILL.md | New agent instructions for reviewing exported Conditional Access policies and reporting findings as recommendations only. |
| submissions/conditional-access-review/README.md | Human-facing overview, export instructions, limitations, and reference links for the skill. |
| submissions/conditional-access-review/metadata.json | Registers the new skill submission with required metadata and platform targeting. |
| every Conditional Access policy. | ||
| - **No emergency access accounts found at all** in any policy's exclusions. | ||
| Flag this as a standalone finding regardless of individual policy design. | ||
| - **Conflicts**: two policies targeting the same scope with contradictory |
There was a problem hiding this comment.
If any applicable policy says block, the user is blocked. A block policy and a grant policy should not not produce a "weaker-than-intended result, as the platform resolves it deterministically, citing MS docs: "If there's a policy that is configured with the block grant control, enforcement stops here and the user is blocked"
| - Admin roles covered by phishing-resistant MFA or Privileged Identity | ||
| Management-gated access | ||
|
|
||
| 5. Check for the following, reporting every hit: |
There was a problem hiding this comment.
If the export contains only policy rules with user and group ID numbers, how will the skill can't truthfully say a group is "large," confirm admins or guests are covered, or claim no emergency account exists, in this case?
| ``` | ||
|
|
||
| via Graph Explorer or the Microsoft Graph PowerShell SDK | ||
| (`Get-MgIdentityConditionalAccessPolicy`). Strip any bearer token before |
There was a problem hiding this comment.
Even if the export has no secrets in it , information is still sensitive, as it maps out which apps are protected and where MFA isn't enforced. Worth treating it as sensitive security config rather than harmless and call this out.
Review an exported set of Microsoft Entra Conditional Access policies for coverage gaps, missing break-glass exclusions, policy conflicts, and configuration hygiene. Recommendations only, never a live change.