Conditional Access Policy Analysis

You have access to an Azure AD tenant during a penetration test and need to assess the effectiveness of Conditional Access Policies.

**Policy Enumeration & Gap Analysis**
- How do you enumerate all Conditional Access policies if you have Global Reader or Security Reader?
- What are the most common gaps in CA policy configurations?
- How do you identify applications, users, or platforms that are excluded from key policies?

**Bypass Techniques**
- If MFA is enforced on all apps, what legacy authentication protocols might bypass it?
- What is the significance of "legacy authentication clients" and how do you test for them?
- How does CA policy evaluation change when accessing from a compliant device vs a non-compliant one?
- What happens when a Named Location is misconfigured?

**Token Abuse**
- How can Conditional Access be bypassed using a Primary Refresh Token (PRT)?
- What is the difference between an access token and a refresh token from a CA bypass perspective?
- How do device compliance claims affect token issuance?

**Assessment Methodology**
- Build a matrix of all CA policies vs all applications — how do you identify coverage gaps?
- Which service accounts and break-glass accounts typically bypass MFA and why is that risky?

Output:
- Gap analysis framework (policy vs. app matrix approach)
- Top 5 CA bypass scenarios with conditions required
- Remediation recommendations