Using KQL to Detect Gaps in your Conditional Access Strategy

What it is

A defensive detection technique from attackthesoc.com: rather than testing Conditional Access (CA) policy coverage with what-if simulators, it inverts each CA policy into a KQL detection that fires when a sign-in occurs that the policy should have prevented. The post walks through two concrete examples built on Microsoft's CA policy templates, with working queries against Microsoft Sentinel / Entra SigninLogs and ExposureGraphEdges.

How it works

For each policy you articulate what shouldn't happen, then detect that activity. The Require MFA for administrators example: build the target population from ExposureGraphEdges (member of a named group) plus IdentityInfo where AssignedRoles matches a list of privileged roles, then find their successful single-factor sign-ins:

let firstPartyIds = dynamic(["c2ada927-a9e2-4564-aae2-70775a2fa0af","04436913-cf0d-4d2a-9cc6-2ffe7f1d3d1c"]);
let excludedResourceIds = dynamic([]);
let CAPTargetGroup = materialize(ExposureGraphEdges
| where EdgeLabel == "member of" and TargetNodeLabel == "group"
| where TargetNodeName == "<GROUP_NAME>"
| distinct SourceNodeName);
let privilegedRoles = dynamic(["Global Administrator", "Application Administrator", ... "User Administrator"]);
let CAPTargetAdmins = IdentityInfo
| where AssignedRoles has_any(privilegedRoles)
| distinct AccountDisplayName;
SigninLogs
| where Identity in (CAPTargetGroup, CAPTargetAdmins)
| where ResultType == 0
| where AuthenticationRequirement == @"singleFactorAuthentication"
| where ResourceId !in (firstPartyIds, excludedResourceIds)
| where AppDisplayName != @"Windows Sign In"

The key filters: ResultType == 0 (successful), AuthenticationRequirement == "singleFactorAuthentication" (MFA didn't happen), minus first-party Microsoft resources that CA can't target and Windows Sign In. A second example (trusted-location + company-owned-device policy) is only partially shown before the text cuts off.

Preconditions / Affected

Requires Microsoft Sentinel / Advanced Hunting with SigninLogs, IdentityInfo, and ExposureGraphEdges (the latter implies Defender Exposure Management data) ingested. You must supply your own <GROUP_NAME>, excluded resource IDs, and app display names — the detections encode your stated CA strategy, so they're only as correct as your understanding of it.

What to do

Translate each CA policy into an inverse detection using the pattern above. The post also lists existing tools worth knowing before rolling your own: the built-in Conditional Access Gap Analyzer Workbook (Entra Admin Center > Identity > Monitoring & health > Workbooks), Maester (PowerShell what-if testing framework), DCToolbox CAP what-if simulation, CA Optics (archived), and MFASweep (Beau Bullock's tool that attempts auth against Microsoft services to surface single-factor gaps).

Caveats

Detections fire on gaps that have already been exploited in your logs — they catch drift after the fact, not before, so pair them with the what-if simulators for pre-emptive testing. The two hardcoded firstPartyIds and the privileged-role list are the author's choices; you must verify they match your tenant. The second KQL example is incomplete in the source text.