Security defaults or Conditional Access: which is protecting the tenant?

#Requires -Modules Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns
# Security defaults state and Conditional Access policy counts by state. Read-only.

Connect-MgGraph -Scopes 'Policy.Read.All' -NoWelcome

$securityDefaults = Get-MgPolicyIdentitySecurityDefaultEnforcementPolicy
$policies = @(Get-MgIdentityConditionalAccessPolicy -All -Property 'id', 'displayName', 'state')

[pscustomobject]@{
    SecurityDefaultsEnabled = $securityDefaults.IsEnabled
    CAPoliciesEnabled       = @($policies | Where-Object { "$($_.State)" -eq 'enabled' }).Count
    CAPoliciesReportOnly    = @($policies | Where-Object { "$($_.State)" -eq 'enabledForReportingButNotEnforced' }).Count
    CAPoliciesDisabled      = @($policies | Where-Object { "$($_.State)" -eq 'disabled' }).Count
}

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

• SecurityDefaultsEnabled is the isEnabled property of the identitySecurityDefaultsEnforcementPolicy.
• Conditional Access counts use each policy's state: enabled, enabledForReportingButNotEnforced (report-only) or disabled. Report-only policies are evaluated and logged but not enforced.
• If security defaults are off and no Conditional Access policy is enabled, neither of these tenant-wide controls is in force. The export script in this library lists each policy in full.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.