我们可以通过 Graph API 访问条件访问的假设功能吗？

Question

We are using Azure AD through APIs. I'm looking for an equivalent of https://policysim.aws.amazon.com/ in Azure. The goal is to provide the user context, resource context and Action, and evaluate "Effective Privileges" for the user to perform that specific action on the resource. Came across What-If in Azure AD for conditional access. Is this the closest feature available? How do I access through Graph APIs?

Thanks much.

Answer 1

The What If Tool can be considered as the closest feature available when compared to IAM policy simulator.

In the Conditional Access What If tool, you first need to configure the settings of the sign-in scenario you want to simulate. These settings include:

• The user you want to test (user context)
• The cloud apps the user would attempt to access (resource context )
• The conditions under which access to the configured cloud apps is performed.

As a next step, you can initiate (Action) a simulation run that evaluates your settings. Only policies that are enabled are part of an evaluation run.When the evaluation has finished, the tool generates a report of the affected policies.

Currently, it is not possible to access What If Tool via Graph APIs, you can, however, voice your interest in such a feature or support similar ones in the Microsoft Graph Feature Requests forum. You can use Conditional Access APIs to create, list, get, update & delete the Conditional access policies