Skip to content
MaesterMaester
3.0 preview2.3.0 stable

These docs describe the preview. Pick the version you run and every page marks what it doesn't have yet. Get the preview →
Maester 2.x docs (archived) →

Sponsor

Test-MtConditionalAccessWhatIf

SYNOPSIS

Section titled “SYNOPSIS”

Tests Conditional Access evaluation with What If for a given scenario.

SYNTAX

Section titled “SYNTAX”

ApplicationBasedCA (Default)

Section titled “ApplicationBasedCA (Default)”
Test-MtConditionalAccessWhatIf [-UserId] <String> -IncludeApplications <String[]> [-DevicePlatform <String>]
 [-ClientAppType <String>] [-SignInRiskLevel <String>] [-UserRiskLevel <String>] [-InsiderRiskLevel <String>]
 [-ServicePrincipalRiskLevel <String>] [-DeviceInfo <Hashtable>] [-Country <String>] [-IpAddress <String>]
 [-AllResults] [-ProgressAction <ActionPreference>] [<CommonParameters>]

UserActionBasedCA

Section titled “UserActionBasedCA”
Test-MtConditionalAccessWhatIf [-UserId] <String> [-UserAction <String[]>] [-DevicePlatform <String>]
 [-ClientAppType <String>] [-SignInRiskLevel <String>] [-UserRiskLevel <String>] [-InsiderRiskLevel <String>]
 [-ServicePrincipalRiskLevel <String>] [-DeviceInfo <Hashtable>] [-Country <String>] [-IpAddress <String>]
 [-AllResults] [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION

Section titled “DESCRIPTION”

This function tests a Conditional Access evaluation with What If for a given scenario.

The function uses the Microsoft Graph API to evaluate the Conditional Access policies.

Learn more: https://learn.microsoft.com/entra/identity/conditional-access/what-if-tool https://learn.microsoft.com/powershell/module/microsoft.graph.beta.identity.signins/test-mgbetaidentityconditionalaccess?view=graph-powershell-beta

EXAMPLES

Section titled “EXAMPLES”

EXAMPLE 1

Section titled “EXAMPLE 1”
Test-MtConditionalAccessWhatIf -UserId '7a6da1c3-616a-416b-a820-cbe4fa8e225e' `
-IncludeApplications '00000002-0000-0ff1-ce00-000000000000' `
-ClientAppType 'exchangeActiveSync'

This example tests the Conditional Access policies for a user signing into Exchange Online using a legacy Mail client that relies on basic authentication.

EXAMPLE 2

Section titled “EXAMPLE 2”
Test-MtConditionalAccessWhatIf -UserId '7a6da1c3-616a-416b-a820-cbe4fa8e225e' `
-UserAction 'registerOrJoinDevices'

This example tests the Conditional Access policies for a user registering or joining a device to Microsoft Entra.

EXAMPLE 3

Section titled “EXAMPLE 3”
Test-MtConditionalAccessWhatIf -UserId '7a6da1c3-616a-416b-a820-cbe4fa8e225e' `
-IncludeApplications '67ad5377-2d78-4ac2-a867-6300cda00e85' `
-Country 'FR' -IpAddress '92.205.185.202'

This example tests the Conditional Access policies for a user signing into Office 365 from France with a specific IP address.

EXAMPLE 4

Section titled “EXAMPLE 4”
Test-MtConditionalAccessWhatIf -UserId '7a6da1c3-616a-416b-a820-cbe4fa8e225e' `
-IncludeApplications '67ad5377-2d78-4ac2-a867-6300cda00e85' `
-SignInRiskLevel 'High' -DevicePlatform 'iOS'

This example tests the Conditional Access policies for a user signing into Office 365 from an iOS device with a High sign-in risk level.

EXAMPLE 5

Section titled “EXAMPLE 5”
Test-MtConditionalAccessWhatIf -UserId '7a6da1c3-616a-416b-a820-cbe4fa8e225e' `
-IncludeApplications 'bbad9299-f060-4e15-9a9a-285980ae00fc' `
-DeviceInfo @{ 'isCompliant' = 'true'; 'Manufacturer' = 'Dell' } `
-InsiderRiskLevel 'Minor'

This example tests the Conditional Access policies for a user accessing an application from a compliant, Dell device with a Minor insider risk level.

EXAMPLE 6

Section titled “EXAMPLE 6”
Test-MtConditionalAccessWhatIf -UserId '7a6da1c3-616a-416b-a820-cbe4fa8e225e' `
-IncludeApplications 'a7936c39-024c-4148-a9b3-f88f2e9406f6' `
-ServicePrincipalRiskLevel 'High' -Verbose

This example tests the Conditional Access policies for a service principal user accessing the application with a High service principal risk level. It will return all applied results, including the report-only and disabled policies.

PARAMETERS

Section titled “PARAMETERS”

-UserId

Section titled “-UserId”

The id of the user sign-in that is being tested. Must be a valid userId (GUID). UserId can be looked up by $id = (Get-MgUser -UserId '[email protected]').id

Type: String
Parameter Sets: (All)
Aliases:


Required: True
Position: 1
Default value: None
Accept pipeline input: True (ByPropertyName, ByValue)
Accept wildcard characters: False

-IncludeApplications

Section titled “-IncludeApplications”

The id of the application the user is signing into. Must be a valid application ID (GUID) Application ID can be looked up from from the sign in logs. The id of the Office 365 application is ‘67ad5377-2d78-4ac2-a867-6300cda00e85’

Type: String[]
Parameter Sets: ApplicationBasedCA
Aliases:


Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-UserAction

Section titled “-UserAction”

The user action that should be tested. Values can be registerOrJoinDevices or registerSecurityInformation

Type: String[]
Parameter Sets: UserActionBasedCA
Aliases:


Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-DevicePlatform

Section titled “-DevicePlatform”

Device platform to be used for the test. Values can be all, Android, iOS, windows, windowsPhone, macOS, linux

Type: String
Parameter Sets: (All)
Aliases:


Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-ClientAppType

Section titled “-ClientAppType”

The client app used by the user. Values can be browser, mobileAppsAndDesktopClients, exchangeActiveSync, easSupported, other

Type: String
Parameter Sets: (All)
Aliases:


Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-SignInRiskLevel

Section titled “-SignInRiskLevel”

Sign-in risk level for the test. Values can be None, Low, Medium, High

Type: String
Parameter Sets: (All)
Aliases:


Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-UserRiskLevel

Section titled “-UserRiskLevel”

User risk level for the test. Values can be None, Low, Medium, High

Type: String
Parameter Sets: (All)
Aliases:


Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-InsiderRiskLevel

Section titled “-InsiderRiskLevel”

Insider risk level for the test. Values can be Minor, Moderate, Elevated

Type: String
Parameter Sets: (All)
Aliases:


Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-ServicePrincipalRiskLevel

Section titled “-ServicePrincipalRiskLevel”

Service Principal risk level for the test. Values can be None, Low, Medium, High

Type: String
Parameter Sets: (All)
Aliases:


Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-DeviceInfo

Section titled “-DeviceInfo”

[(Any) <Object>]: This indicates any property can be added to this object. [DeviceId <String>]: [DisplayName <String>]: [EnrollmentProfileName <String>]: [ExtensionAttribute1 <String>]: [ExtensionAttribute10 <String>]: [ExtensionAttribute11 <String>]: [ExtensionAttribute12 <String>]: [ExtensionAttribute13 <String>]: [ExtensionAttribute14 <String>]: [ExtensionAttribute15 <String>]: [ExtensionAttribute2 <String>]: [ExtensionAttribute3 <String>]: [ExtensionAttribute4 <String>]: [ExtensionAttribute5 <String>]: [ExtensionAttribute6 <String>]: [ExtensionAttribute7 <String>]: [ExtensionAttribute8 <String>]: [ExtensionAttribute9 <String>]: [IsCompliant <Boolean?>]: [Manufacturer <String>]: [MdmAppId <String>]: [Model <String>]: [OperatingSystem <String>]: [OperatingSystemVersion <String>]: [Ownership <String>]: [PhysicalIds <String []>]: [ProfileType <String>]: [SystemLabels <String []>]: [TrustType <String>]:

Type: Hashtable
Parameter Sets: (All)
Aliases:


Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-Country

Section titled “-Country”

Country to be used for the test. The two-letter country code.

Type: String
Parameter Sets: (All)
Aliases:


Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-IpAddress

Section titled “-IpAddress”

IP address to be used for the test. e.g. 10.142.84.49

Type: String
Parameter Sets: (All)
Aliases:


Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-AllResults

Section titled “-AllResults”

Output all results, not only the applied policies.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:


Required: False
Position: Named
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-ProgressAction

Section titled “-ProgressAction”

Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga


Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

Section titled “CommonParameters”

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

Section titled “INPUTS”

OUTPUTS

Section titled “OUTPUTS”

System.Object

Section titled “System.Object”

NOTES

Section titled “NOTES”
Section titled “RELATED LINKS”

https://maester.dev/docs/commands/Test-MtConditionalAccessWhatIf

Maester is free and open source under the MIT licence.SponsorContributorsDiscordMaester Cloud