Conditional Access covers all cloud apps

​

What this check verifies

Microsoft Entra Conditional Access has at least one policy configured to target all cloud apps. This ensures comprehensive security coverage and automatic protection for newly onboarded applications without requiring policy updates.

​

Risk

Without a policy targeting all cloud apps, newly integrated applications may not be protected by Conditional Access. This creates security gaps where users could access sensitive resources without proper authentication controls.

​

Recommendation

Create at least one Conditional Access policy that targets all cloud apps to ensure comprehensive protection. Use exclusions to handle applications requiring different access controls rather than creating narrow policies for each application.

​

Remediation

Dashboard steps

1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com.
2. Expand Protection > Conditional Access and select Policies.
3. Create a new policy by selecting New policy.
4. Under Target resources, select All cloud apps.
5. Configure appropriate exclusions for applications that require different policies.
6. Set the desired access controls (e.g., require MFA, compliant device).
7. Set the policy to On and click Create.

​

References

• https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_all_apps_conditional_access_coverage. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks