Skip to content
microsoftadmin.in

Export all Conditional Access policies to JSON and CSV with Microsoft Graph

What it does

Section titled “What it does”
  • Connects to Microsoft Graph with read-only permission (Policy.Read.All).
  • Saves each Conditional Access policy as its own JSON file — a backup you can compare or restore from.
  • Writes summary.csv with state, included/excluded users and groups, apps and grant controls.

It changes nothing in your tenant.

Prerequisites

Section titled “Prerequisites”
Terminal window
Install-Module Microsoft.Graph.Identity.SignIns -Scope CurrentUser

Script

Section titled “Script”
Terminal window
#Requires -Version 7.0
#Requires -Modules Microsoft.Graph.Identity.SignIns
<#
  Export-CAPolicies.ps1 — read-only backup of all Conditional Access policies.
  Output: a timestamped folder with one JSON file per policy and summary.csv.
#>
Connect-MgGraph -Scopes 'Policy.Read.All' -NoWelcome


$outDir = Join-Path $PWD ('CA-export-{0:yyyyMMdd-HHmm}' -f (Get-Date))
New-Item -ItemType Directory -Path $outDir | Out-Null


$policies = Get-MgIdentityConditionalAccessPolicy -All


foreach ($p in $policies) {
    $safeName = $p.DisplayName -replace '[\\/:*?"<>|]', '_'
    $p | ConvertTo-Json -Depth 10 |
        Out-File -FilePath (Join-Path $outDir "$safeName.json") -Encoding utf8
}


$policies | Select-Object DisplayName, State, CreatedDateTime, ModifiedDateTime,
    @{ n = 'IncludeUsers';  e = { $_.Conditions.Users.IncludeUsers -join ';' } },
    @{ n = 'ExcludeUsers';  e = { $_.Conditions.Users.ExcludeUsers -join ';' } },
    @{ n = 'IncludeGroups'; e = { $_.Conditions.Users.IncludeGroups -join ';' } },
    @{ n = 'ExcludeGroups'; e = { $_.Conditions.Users.ExcludeGroups -join ';' } },
    @{ n = 'IncludeApps';   e = { $_.Conditions.Applications.IncludeApplications -join ';' } },
    @{ n = 'ClientApps';    e = { $_.Conditions.ClientAppTypes -join ';' } },
    @{ n = 'GrantControls'; e = { $_.GrantControls.BuiltInControls -join ';' } } |
    Export-Csv -Path (Join-Path $outDir 'summary.csv') -NoTypeInformation -Encoding utf8


Write-Host "Exported $($policies.Count) policies to $outDir"
Disconnect-MgGraph | Out-Null

Output

Section titled “Output”
File Contents
<policy name>.json Full policy definition, one per policy
summary.csv One row per policy — open in Excel to review exclusions quickly

Notes

Section titled “Notes”
  • Users and groups appear as object IDs. Resolve them with Get-MgUser -UserId <id> or Get-MgGroup -GroupId <id>.
  • Run it before every Conditional Access change and keep the folder with your change record.
  • Store exports securely — they describe your security controls.

Weekly · 5-minute read

The Identity Brief

Identity & Microsoft 365 changes that need action, one SOP, one script — every week. Verified against official Microsoft sources.

No spam. Unsubscribe anytime. Privacy