Conditional Access covers all cloud apps and users

​

What this check verifies

Helper check that verifies whether Microsoft Entra Conditional Access includes at least one enabled policy scoped to all cloud applications and all users. Policies that only require a password change and report-only policies are excluded from passing. The result is intended to support other, more specific Conditional Access checks rather than enforce a baseline on its own.

​

Risk

Without a Conditional Access policy that targets all cloud apps and all users, newly added applications or user accounts may not be covered by existing access controls until policies are explicitly updated.

​

Recommendation

Ensure there is at least one enabled Conditional Access policy that targets all cloud apps and all users so that other Conditional Access checks have broad coverage to evaluate. Exclude only break-glass accounts.

​

Remediation

Dashboard steps

1. Navigate to the Microsoft Entra admin center at https://entra.microsoft.com.
2. Expand Protection > Conditional Access and select Policies.
3. Click New policy.
4. Under Users, select Include > All users. Exclude break-glass accounts as needed.
5. Under Target resources, select Include > All cloud apps.
6. Under Grant, select the desired access controls.
7. Set the policy to On and click Create.

​

References

• https://learn.microsoft.com/en-us/entra/identity/conditional-access/plan-conditional-access
• https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_conditional_access_policy_all_apps_all_users. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks