Test-MtCaUntargetedPolicy
SYNOPSIS
Checks if any Conditional Access policy is not targeted to any resource.
SYNTAX
Test-MtCaUntargetedPolicy [-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Neither the Entra admin center nor Microsoft Graph require a Conditional Access policy to target at least one resource (cloud apps, user actions, or authentication context). Such a policy is accepted, can be enabled, and appears like any other policy - but it applies to nothing and enforces nothing. This check also recognizes apps targeted dynamically through a custom security attribute filter, so it doesn't flag policies that are legitimately scoped that way.
This gives a false sense of security: the policy looks like active protection, but has no effect.
EXAMPLES
EXAMPLE 1
Test-MtCaUntargetedPolicy
Returns true if all Conditional Access policies target at least one resource.
PARAMETERS
-ProgressAction
Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.