KBY Technologies Logo
Microsoft Entra ID · PowerShell 7.6

Export Conditional Access policies to JSON

What exactly do our Conditional Access policies say right now? Saves every policy to one JSON file you can diff or keep as a baseline before a change.

Script

#Requires -Modules Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns
# Saves all Conditional Access policies to a local JSON file. Read-only against the tenant.
param(
    [string]$Path = (Join-Path -Path (Get-Location).Path -ChildPath 'conditional-access-policies.json')
)

Connect-MgGraph -Scopes 'Policy.Read.All' -NoWelcome

$policies = Get-MgIdentityConditionalAccessPolicy -All
$policies | ConvertTo-Json -Depth 20 | Out-File -FilePath $Path -Encoding utf8

$policies |
    Sort-Object DisplayName |
    Select-Object DisplayName, State, CreatedDateTime, ModifiedDateTime, Id
Write-Output "Saved $($policies.Count) policies to $Path"

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

  • Writes one local file (default: conditional-access-policies.json in the current folder). Nothing in the tenant changes.
  • Pass -Path to choose the file. Compare two exports with any JSON diff tool.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.

Connect-MgGraph (Microsoft.Graph.Authentication)Get-MgIdentityConditionalAccessPolicy (Microsoft.Graph.Identity.SignIns)List policies (conditionalAccessRoot): permissions and supported rolesJoin-Path (Microsoft.PowerShell.Management)Get-Location (Microsoft.PowerShell.Management)ConvertTo-Json (Microsoft.PowerShell.Utility)Out-File (Microsoft.PowerShell.Utility)Sort-Object (Microsoft.PowerShell.Utility)Select-Object (Microsoft.PowerShell.Utility)Write-Output (Microsoft.PowerShell.Utility)
All scripts