MT.1066: Conditional Access policies should not reference non-existent users, groups, or roles.

ID	MT.1066
Severity	Medium
Suite	Mito
Product	Entra ID
Feature	Conditional Access
Security area	Access control
Resource type	ConditionalAccessPolicy
User impact of fixing	Low
Effort to fix	Low
MITRE ATT&CK	T1078.004
Reads from	Microsoft Graph

What this checks and how to fix it

Conditional Access policies should not reference non-existent users, groups, or roles

This test checks if there are any Conditional Access policies that reference non-existent users, groups, or roles.

This usually happens when a user, group, or role is deleted but is still referenced in a Conditional Access policy.

Non-existent objects in your policy can lead to unexpected gaps or behavior. This may result in Conditional Access policies not being applied to the intended users or the policy not functioning as expected.

How to fix

To fix this issue:

• Open the impacted Conditional Access policy.
• Remove the non-existent user, group, or role from the policy.
• If the object is still needed, recreate it or replace it with a valid alternative.
• Click Save to apply the changes.

Learn more

• Conditional Access: Users and groups
• Manage Conditional Access policies

---

Mito check. Author: SamErde. Open-source licences.