# Test-MtConditionalAccessWhatIf

Tests Conditional Access evaluation with What If for a given scenario.

Source: https://maester.dev/docs/commands/Test-MtConditionalAccessWhatIf

## SYNOPSIS

Tests Conditional Access evaluation with What If for a given scenario.

## SYNTAX

### ApplicationBasedCA (Default)

```powershell
Test-MtConditionalAccessWhatIf [-UserId] <String> -IncludeApplications <String[]> [-DevicePlatform <String>]
 [-ClientAppType <String>] [-SignInRiskLevel <String>] [-UserRiskLevel <String>] [-InsiderRiskLevel <String>]
 [-ServicePrincipalRiskLevel <String>] [-DeviceInfo <Hashtable>] [-Country <String>] [-IpAddress <String>]
 [-AllResults] [-ProgressAction <ActionPreference>] [<CommonParameters>]
```

### UserActionBasedCA

```powershell
Test-MtConditionalAccessWhatIf [-UserId] <String> [-UserAction <String[]>] [-DevicePlatform <String>]
 [-ClientAppType <String>] [-SignInRiskLevel <String>] [-UserRiskLevel <String>] [-InsiderRiskLevel <String>]
 [-ServicePrincipalRiskLevel <String>] [-DeviceInfo <Hashtable>] [-Country <String>] [-IpAddress <String>]
 [-AllResults] [-ProgressAction <ActionPreference>] [<CommonParameters>]
```

## DESCRIPTION

This function tests a Conditional Access evaluation with What If for a given scenario.

The function uses the Microsoft Graph API to evaluate the Conditional Access policies.

Learn more:
https://learn.microsoft.com/entra/identity/conditional-access/what-if-tool
https://learn.microsoft.com/powershell/module/microsoft.graph.beta.identity.signins/test-mgbetaidentityconditionalaccess?view=graph-powershell-beta

## EXAMPLES

### EXAMPLE 1

```powershell
Test-MtConditionalAccessWhatIf -UserId '7a6da1c3-616a-416b-a820-cbe4fa8e225e' `
-IncludeApplications '00000002-0000-0ff1-ce00-000000000000' `
-ClientAppType 'exchangeActiveSync'
```

This example tests the Conditional Access policies for a user signing into Exchange Online using a legacy Mail client that relies on basic authentication.

### EXAMPLE 2

```powershell
Test-MtConditionalAccessWhatIf -UserId '7a6da1c3-616a-416b-a820-cbe4fa8e225e' `
-UserAction 'registerOrJoinDevices'
```

This example tests the Conditional Access policies for a user registering or joining a device to Microsoft Entra.

### EXAMPLE 3

```powershell
Test-MtConditionalAccessWhatIf -UserId '7a6da1c3-616a-416b-a820-cbe4fa8e225e' `
-IncludeApplications '67ad5377-2d78-4ac2-a867-6300cda00e85' `
-Country 'FR' -IpAddress '92.205.185.202'
```

This example tests the Conditional Access policies for a user signing into **Office 365** from **France** with a specific **IP address**.

### EXAMPLE 4

```powershell
Test-MtConditionalAccessWhatIf -UserId '7a6da1c3-616a-416b-a820-cbe4fa8e225e' `
-IncludeApplications '67ad5377-2d78-4ac2-a867-6300cda00e85' `
-SignInRiskLevel 'High' -DevicePlatform 'iOS'
```

This example tests the Conditional Access policies for a user signing into **Office 365** from an **iOS** device with a **High** sign-in risk level.

### EXAMPLE 5

```powershell
Test-MtConditionalAccessWhatIf -UserId '7a6da1c3-616a-416b-a820-cbe4fa8e225e' `
-IncludeApplications 'bbad9299-f060-4e15-9a9a-285980ae00fc' `
-DeviceInfo @{ 'isCompliant' = 'true'; 'Manufacturer' = 'Dell' } `
-InsiderRiskLevel 'Minor'
```

This example tests the Conditional Access policies for a user accessing an **application** from a **compliant**, **Dell** device with a **Minor** insider risk level.

### EXAMPLE 6

```powershell
Test-MtConditionalAccessWhatIf -UserId '7a6da1c3-616a-416b-a820-cbe4fa8e225e' `
-IncludeApplications 'a7936c39-024c-4148-a9b3-f88f2e9406f6' `
-ServicePrincipalRiskLevel 'High' -Verbose
```

This example tests the Conditional Access policies for a service principal user accessing the **application** with a **High** service principal risk level.
It will return all applied results, including the report-only and disabled policies.

## PARAMETERS

### -UserId

The id of the user sign-in that is being tested.
Must be a valid userId (GUID).
UserId can be looked up by `$id = (Get-MgUser -UserId 'john@contoso.com').id`

```yaml
Type: String
Parameter Sets: (All)
Aliases:

Required: True
Position: 1
Default value: None
Accept pipeline input: True (ByPropertyName, ByValue)
Accept wildcard characters: False
```

### -IncludeApplications

The id of the application the user is signing into.
Must be a valid application ID (GUID)
Application ID can be looked up from from the sign in logs.
The id of the Office 365 application is '67ad5377-2d78-4ac2-a867-6300cda00e85'

```yaml
Type: String[]
Parameter Sets: ApplicationBasedCA
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
```

### -UserAction

The user action that should be tested.
Values can be registerOrJoinDevices or registerSecurityInformation

```yaml
Type: String[]
Parameter Sets: UserActionBasedCA
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
```

### -DevicePlatform

Device platform to be used for the test.
Values can be all, Android, iOS, windows, windowsPhone, macOS, linux

```yaml
Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
```

### -ClientAppType

The client app used by the user.
Values can be browser, mobileAppsAndDesktopClients, exchangeActiveSync, easSupported, other

```yaml
Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
```

### -SignInRiskLevel

Sign-in risk level for the test.
Values can be None, Low, Medium, High

```yaml
Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
```

### -UserRiskLevel

User risk level for the test.
Values can be None, Low, Medium, High

```yaml
Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
```

### -InsiderRiskLevel

Insider risk level for the test.
Values can be Minor, Moderate, Elevated

```yaml
Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
```

### -ServicePrincipalRiskLevel

Service Principal risk level for the test.
Values can be None, Low, Medium, High

```yaml
Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
```

### -DeviceInfo

[DeviceInfo &lt;IMicrosoftGraphDeviceInfo&gt;]: deviceInfo
 		[(Any) &lt;Object&gt;]: This indicates any property can be added to this object.
 		[DeviceId &lt;String&gt;]:
 		[DisplayName &lt;String&gt;]:
 		[EnrollmentProfileName &lt;String&gt;]:
 		[ExtensionAttribute1 &lt;String&gt;]:
 		[ExtensionAttribute10 &lt;String&gt;]:
 		[ExtensionAttribute11 &lt;String&gt;]:
 		[ExtensionAttribute12 &lt;String&gt;]:
 		[ExtensionAttribute13 &lt;String&gt;]:
 		[ExtensionAttribute14 &lt;String&gt;]:
 		[ExtensionAttribute15 &lt;String&gt;]:
 		[ExtensionAttribute2 &lt;String&gt;]:
 		[ExtensionAttribute3 &lt;String&gt;]:
 		[ExtensionAttribute4 &lt;String&gt;]:
 		[ExtensionAttribute5 &lt;String&gt;]:
 		[ExtensionAttribute6 &lt;String&gt;]:
 		[ExtensionAttribute7 &lt;String&gt;]:
 		[ExtensionAttribute8 &lt;String&gt;]:
 		[ExtensionAttribute9 &lt;String&gt;]:
 		[IsCompliant &lt;Boolean?&gt;]:
 		[Manufacturer &lt;String&gt;]:
 		[MdmAppId &lt;String&gt;]:
 		[Model &lt;String&gt;]:
 		[OperatingSystem &lt;String&gt;]:
 		[OperatingSystemVersion &lt;String&gt;]:
 		[Ownership &lt;String&gt;]:
 		[PhysicalIds &lt;String []&gt;]:
 		[ProfileType &lt;String&gt;]:
 		[SystemLabels &lt;String []&gt;]:
 		[TrustType &lt;String&gt;]:

```yaml
Type: Hashtable
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
```

### -Country

Country to be used for the test.
The two-letter country code.

```yaml
Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
```

### -IpAddress

IP address to be used for the test.
e.g.
10.142.84.49

```yaml
Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
```

### -AllResults

Output all results, not only the applied policies.

```yaml
Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
```

### -ProgressAction

Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.

```yaml
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
```

### CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).

## INPUTS

## OUTPUTS

### System.Object

## NOTES

## RELATED LINKS

[https://maester.dev/docs/commands/Test-MtConditionalAccessWhatIf](https://maester.dev/docs/commands/Test-MtConditionalAccessWhatIf)