Identity as Code: Managing Conditional Access with CI/CD

1name: Conditional Access Deployment
2 
3on:
4  pull_request:
5    paths:
6      - 'conditional-access/**'
7  push:
8    branches:
9      - main
10    paths:
11      - 'conditional-access/**'
12 
13jobs:
14  validate:
15    runs-on: ubuntu-latest
16    steps:
17      - uses: actions/checkout@v4
18      
19      - name: Azure Login
20        uses: azure/login@v1
21        with:
22          client-id: ${{ secrets.AZURE_CLIENT_ID }}
23          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
24          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
25      
26      - name: Validate CA Policies
27        run: |
28          az extension add --name account
29          python scripts/validate_ca_policies.py
30      
31      - name: What If Analysis
32        if: github.event_name == 'pull_request'
33        run: |
34          python scripts/whatif_analysis.py --policies ./conditional-access/
35          
36      - name: Deploy Report Mode
37        if: github.ref == 'refs/heads/main'
38        run: |
39          python scripts/deploy_ca_policies.py --mode report-only

1# Deployment of a Conditional Access policy via Graph API
2function Deploy-ConditionalAccessPolicy {
3    param(
4        [Parameter(Mandatory)]
5        [string]$PolicyFile,
6        
7        [Parameter(Mandatory)]
8        [string]$AccessToken,
9        
10        [switch]$ReportOnly
11    )
12    
13    $policy = Get-Content $PolicyFile | ConvertFrom-Json
14    
15    # Mode configuration
16    if ($ReportOnly) {
17        $policy.state = "enabledForReportingButNotEnforced"
18    } else {
19        $policy.state = "enabled"
20    }
21    
22    $headers = @{
23        'Authorization' = "Bearer $AccessToken"
24        'Content-Type' = 'application/json'
25    }
26    
27    $uri = "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies"
28    
29    try {
30        $response = Invoke-RestMethod -Uri $uri -Method POST -Headers $headers -Body ($policy | ConvertTo-Json -Depth 10)
31        Write-Output "Policy deployed: $($response.id)"
32        return $response
33    }
34    catch {
35        Write-Error "Deployment error: $($_.Exception.Message)"
36        throw
37    }
38}
39 
40# What If API Test
41function Test-ConditionalAccessImpact {
42    param(
43        [Parameter(Mandatory)]
44        [hashtable]$TestScenario,
45        
46        [Parameter(Mandatory)]
47        [string]$AccessToken
48    )
49    
50    $headers = @{
51        'Authorization' = "Bearer $AccessToken"
52        'Content-Type' = 'application/json'
53    }
54    
55    $body = @{
56        conditionalAccessWhatIfSubject = @{
57            user = @{
58                id = $TestScenario.UserId
59            }
60        }
61        conditionalAccessWhatIfConditions = @{
62            clientAppType = $TestScenario.ClientApp
63            devicePlatform = $TestScenario.Platform
64            location = @{
65                includeLocations = @($TestScenario.Location)
66            }
67        }
68    } | ConvertTo-Json -Depth 10
69    
70    $uri = "https://graph.microsoft.com/v1.0/identity/conditionalAccess/whatIf"
71    
72    $response = Invoke-RestMethod -Uri $uri -Method POST -Headers $headers -Body $body
73    return $response
74}

1{
2  "auditEvent": {
3    "timestamp": "2026-05-05T10:30:00Z",
4    "action": "ConditionalAccessPolicyDeployed",
5    "actor": "pipeline@contoso.com",
6    "resource": "CA-RequireMFA-Externals",
7    "details": {
8      "policyId": "12345678-1234-1234-1234-123456789012",
9      "state": "enabledForReportingButNotEnforced",
10      "commitSha": "abc123def456"
11    }
12  }
13}

1# Automated test suite
2$TestSuites = @(
3    @{
4        Name = "Internal User Corporate Network"
5        UserId = "user@contoso.com"
6        ClientApp = "browser"
7        Platform = "windows"
8        Location = "Corporate-Network"
9        ExpectedResult = "Allow"
10    },
11    @{
12        Name = "External User Mobile"
13        UserId = "external@partner.com"
14        ClientApp = "mobileAppsAndDesktopClients"
15        Platform = "iOS"
16        Location = "All"
17        ExpectedResult = "RequireMFA"
18    }
19)
20 
21foreach ($test in $TestSuites) {
22    $result = Test-ConditionalAccessImpact -TestScenario $test -AccessToken $token
23    
24    if ($result.applyResult -ne $test.ExpectedResult) {
25        throw "Test failed: $($test.Name) - Expected: $($test.ExpectedResult), Got: $($result.applyResult)"
26    }
27    
28    Write-Output "✓ Test passed: $($test.Name)"
29}