MT.1184: Conditional Access policy without any target resources configured.
| ID | MT.1184 |
| Severity | Medium |
| Suite | Mito |
| Product | Entra ID |
| Feature | Conditional Access |
| Security area | Access control |
| Resource type | ConditionalAccessPolicy |
| User impact of fixing | Low |
| Effort to fix | Low |
| MITRE ATT&CK | T1078.004 |
| Reads from | Microsoft Graph |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Checks if any Conditional Access policy is not targeted to any resource.
It’s possible to create and even enable a Conditional Access policy without selecting any target resources - cloud apps, user actions, or authentication context. The policy is accepted and appears in the portal like any other policy, but it applies to nothing and enforces nothing.
An untargeted policy gives a false sense of security: it looks like active protection, but has no effect. This commonly happens when a policy is created as a draft and never finished, or when an admin forgets to select a target before saving.
Remediation action
Section titled “Remediation action”- Open the impacted policy in Conditional Access policies.
- Under Target resources, configure at least one of: cloud apps, user actions, or authentication context.
- If the policy is no longer needed, delete it instead of leaving it untargeted.
Related links
Section titled “Related links”Mito check. Author: BakkerJan. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.