MT.1184 - Conditional Access policy without any target resources configured
Overview
Checks if any Conditional Access policy is not targeted to any resource.
It's possible to create and even enable a Conditional Access policy without selecting any target resources - cloud apps, user actions, or authentication context. The policy is accepted and appears in the portal like any other policy, but it applies to nothing and enforces nothing.
An untargeted policy gives a false sense of security: it looks like active protection, but has no effect. This commonly happens when a policy is created as a draft and never finished, or when an admin forgets to select a target before saving.
Remediation action:
- Open the impacted policy in Conditional Access policies.
- Under Target resources, configure at least one of: cloud apps, user actions, or authentication context.
- If the policy is no longer needed, delete it instead of leaving it untargeted.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1184 |
| Severity | Medium |
| Suite | Maester |
| Category | CA |
| PowerShell test | Test-MtCaUntargetedPolicy |
| Tags | CA, Maester, MT.1184 |
Source
- Pester test:
tests/Maester/Entra/Test-ConditionalAccessBaseline.Tests.ps1 - PowerShell source:
powershell/public/maester/entra/Test-MtCaUntargetedPolicy.ps1