Conditional Access policies should not reference non-existent users, groups, or roles

Contributed by Sam ErdeAll contributors →

Part of Maester · Entra ID · Conditional Access · All checks

Run this check

Invoke-Maester -TestId MT.1066

Overview

Conditional Access policies should not reference non-existent users, groups, or roles

This test checks if there are any Conditional Access policies that reference non-existent users, groups, or roles.

This usually happens when a user, group, or role is deleted but is still referenced in a Conditional Access policy.

Non-existent objects in your policy can lead to unexpected gaps or behavior. This may result in Conditional Access policies not being applied to the intended users or the policy not functioning as expected.

How to fix

To fix this issue:

• Open the impacted Conditional Access policy.
• Remove the non-existent user, group, or role from the policy.
• If the object is still needed, recreate it or replace it with a valid alternative.
• Click Save to apply the changes.

Learn more

• Conditional Access: Users and groups
• Manage Conditional Access policies

Details

Every attribute of this check

Field	Value
Test ID	MT.1066
Severity	Medium
Suite	Maester
Product	Entra ID
Feature	Conditional Access
Area	Access control
Resource type	ConditionalAccessPolicy
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1078.004 Cloud Accounts
PowerShell test	Test-MtCaReferencedObjectsExist
Services	Graph

Source

• Test: tests/maester/entra/Test.MT.1066.ps1
• Documentation: tests/maester/entra/Test.MT.1066.md