You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/reports-monitoring/how-to-view-applied-conditional-access-policies.md
+19-41Lines changed: 19 additions & 41 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ ms.service: active-directory
9
9
ms.topic: how-to
10
10
ms.workload: identity
11
11
ms.subservice: report-monitor
12
-
ms.date: 10/31/2022
12
+
ms.date: 02/03/2023
13
13
ms.author: sarahlipsey
14
14
ms.reviewer: besiler
15
15
@@ -32,41 +32,30 @@ As an Azure AD administrator, you can use the sign-in logs to:
32
32
33
33
Some scenarios require you to get an understanding of how your Conditional Access policies were applied to a sign-in event. Common examples include:
34
34
35
-
-*Helpdesk administrators* who need to look at applied Conditional Access policies to understand if a policy is the root cause of a ticket that a user opened.
35
+
- Helpdesk administrators who need to look at applied Conditional Access policies to understand if a policy is the root cause of a ticket that a user opened.
36
36
37
-
-*Tenant administrators* who need to verify that Conditional Access policies have the intended effect on the users of a tenant.
37
+
- Tenant administrators who need to verify that Conditional Access policies have the intended effect on the users of a tenant.
38
38
39
39
You can access the sign-in logs by using the Azure portal, Microsoft Graph, and PowerShell.
40
40
41
41
## Required administrator roles
42
42
43
-
To see applied Conditional Access policies in the sign-in logs, administrators must have permissions to view both the logs and the policies.
43
+
To see applied Conditional Access policies in the sign-in logs, administrators must have permissions to view *both* the logs and the policies. The least privileged built-in role that grants *both* permissions is *Security Reader*. As a best practice, your Global Administrator should add the Security Reader role to the related administrator accounts.
44
44
45
-
The least privileged built-in role that grants both permissions is *Security Reader*. As a best practice, your global administrator should add the Security Reader role to the related administrator accounts.
46
-
47
-
The following built-in roles grant permissions to read Conditional Access policies:
45
+
The following built-in roles grant permissions to *read Conditional Access policies*:
48
46
49
47
- Global Administrator
50
-
51
48
- Global Reader
52
-
53
49
- Security Administrator
54
-
55
50
- Security Reader
56
-
57
51
- Conditional Access Administrator
58
52
59
-
60
-
The following built-in roles grant permission to view sign-in logs:
53
+
The following built-in roles grant permission to *view sign-in logs*:
61
54
62
55
- Global Administrator
63
-
64
56
- Security Administrator
65
-
66
57
- Security Reader
67
-
68
58
- Global Reader
69
-
70
59
- Reports Reader
71
60
72
61
## Permissions for client apps
@@ -76,9 +65,7 @@ If you use a client app to pull sign-in logs from Microsoft Graph, your app need
76
65
Any of the following permissions is sufficient for a client app to access applied certificate authority (CA) policies in sign-in logs through Microsoft Graph:
77
66
78
67
-`Policy.Read.ConditionalAccess`
79
-
80
68
-`Policy.ReadWrite.ConditionalAccess`
81
-
82
69
-`Policy.Read.All`
83
70
84
71
## Permissions for PowerShell
@@ -89,37 +76,28 @@ Like any other client app, the Microsoft Graph PowerShell module needs client pe
89
76
-`AuditLog.Read.All`
90
77
-`Directory.Read.All`
91
78
92
-
These permissions are the least privileged permissions with the necessary access.
The following permissions are the least privileged permissions with the necessary access:
99
80
100
-
`Get-MgAuditLogSignIn`
81
+
- To consent to the necessary permissions: `Connect-MgGraph -Scopes Policy.Read.ConditionalAccess, AuditLog.Read.All, Directory.Read.All`
82
+
- To view the sign-in logs: `Get-MgAuditLogSignIn`
101
83
102
84
For more information about this cmdlet, see [Get-MgAuditLogSignIn](/powershell/module/microsoft.graph.reports/get-mgauditlogsignin).
103
85
104
86
The Azure AD Graph PowerShell module doesn't support viewing applied Conditional Access policies. Only the Microsoft Graph PowerShell module returns applied Conditional Access policies.
105
87
106
-
## Confirming access
107
-
108
-
On the **Conditional Access** tab, you see a list of Conditional Access policies applied to that sign-in event.
109
-
110
-
To confirm that you have admin access to view applied Conditional Access policies in the sign-in logs:
111
-
112
-
1. Go to the Azure portal.
113
-
114
-
2. In the upper-right corner, select your directory, and then select **Azure Active Directory** on the left pane.
88
+
## View Conditional Access policies in Azure AD sign-in logs
115
89
116
-
3. In the **Monitoring** section, select **Sign-in logs**.
90
+
The activity details of sign-in logs contain several tabs. The **Conditional Access** tab lists the Conditional Access policies applied to that sign-in event.
117
91
118
-
4. Select an item in the sign-in table to open the **Activity Details: Sign-ins context** pane.
92
+
1. Sign in to the [Azure portal](https://portal.azure.com) using the Security Reader role.
93
+
1. In the **Monitoring** section, select **Sign-in logs**.
94
+
1. Select a sign-in item from the table to open the **Activity Details: Sign-ins context** pane.
95
+
1. Select the **Conditional Access** tab.
119
96
120
-
5. Select the **Conditional Access** tab on the context pane. If your screen is small, you might need to select the ellipsis (**...**) to see all tabs on the context pane.
97
+
If you don't see the Conditional Access policies, confirm you're using a role that provides access to both the sign-in logs and the Conditional Access policies.
0 commit comments