CA Policies
Review all Conditional Access Policies per tenant
This page lists all the Conditional Access Policies on the selected tenant. This lists everything that's available in the Microsoft Endpoint Manager (MEM) portal, including the applications the CA applies to and used built-in controls.
Page Actions
Deploy CA Policy
Conditional Access policies reference users, groups, and named locations by GUID, and those GUIDs are tenant-specific — a template built in tenant A will not resolve correctly when deployed to tenant B unless the references are translated.
CIPP supports two ways to deploy:
Deploy Conditional Access Policy Wizard — single-tenant, one-shot deployment with options for state, exclusions, and how user/group references are translated.
CIPP Standards — template-based deployment that auto-redeploys whenever drift is detected. Standards always use the Replace IDs with Display Names translation mode so templates remain portable across tenants.
Replacement modes
Replace IDs with Display Names (recommended)
Before deployment, CIPP enumerates all users and groups in the target tenant and substitutes any display-name reference in the template's includeUsers / excludeUsers / includeGroups / excludeGroups with the matching object's GUID in the target tenant. Special tokens (All, None, GuestOrExternalUsers) are left alone. Existing GUIDs in the template pass through unchanged.
All Users
Strips all user and group includes/exclusions and scopes the policy to All Users. Use for tenant-wide baseline policies that should not be limited by group membership.
None
Deploys the template verbatim. The original tenant's GUIDs are sent as-is, so this only works if those exact IDs already exist in the target tenant.
"Create groups if missing"
When combined with Replace IDs with Display Names, if a group named in the template does not exist in the target tenant, CIPP creates it automatically:
If a CIPP Group Template with the same display name exists, the group is created from that template (preserving group type, membership rules, etc.).
Otherwise, a basic security group is created with the template's display name.
If this option is disabled and a referenced group is missing, deployment fails with an error so you can create or rename the group manually before retrying.
When deploying any template that originated from a different tenant, you almost always want Replace IDs with Display Names plus Create groups if missing enabled. This is also what CIPP Standards/Drift use internally, which is why standard deployments are portable across tenants without additional configuration.
View Logs
Opens a table of the results from the Logbook for Conditional Access
Table Details
The properties returned are for the Graph resource type conditionalAccessPolicy. For more information on the properties please see the Graph documentation. CIPP does some additional correlation to convert some of the GUID attributes into display names for ease of reading.
Table Actions
Edit Policy
Opens the selected policy to the Edit CA Policy page.
Create template based on policy
Creates a CIPP template based on the selected policy(ies) to deploy to any other tenant [More information]
Change Display Name
Opens modal to change the display name of the selected policy(ies)
Enable policy
Enables the selected policy(ies) for the tenant
Disable policy
Disables the selected policy(ies) for the tenant
Set policy to report only
Opens a modal to set the selected policy(ies) to report only
Add service provider exception to policy
Opens a modal to add a service provider exception to the selected policy(ies)
Delete policy
Opens modal to confirm deletion of the selected policy(ies)
More Info
Opens the Extended Info flyout
Template Creation
Using the action button "Create Template based on rule" you can create a one-off template of a conditional access rule in a tenant that will be available in CA Templates.
Creating a template includes all properties of the conditional policy templated; Inclusions and exclusions are translated and stored in CIPP for redeployment. When redeploying the template on any tenant every setting is included, such as Conditional Access Named locations, Authentication strengths, and any other setting.
Feature Requests / Ideas
We value your feedback and ideas. Please raise any feature requests on GitHub.
Last updated
Was this helpful?

