TL;DR: Conditional access policies only protect the identities and apps they actually reach, and native tooling often leaves teams blind to ungated sign-ins, legacy auth paths, and exclusion drift, according to Abnormal AI. Coverage, not policy count, becomes the real control variable when provisioned identities outnumber active users and gaps compound unnoticed.
At a glance
What this is: This analysis shows that conditional access gaps are a coverage problem, not a policy-count problem, because some identities and applications never enter policy scope at all.
Why it matters: IAM and security teams need coverage visibility to prove where MFA, exclusions, and legacy authentication leave identities outside conditional access enforcement.
Context
Conditional access coverage is the reach of policy across identities, applications, and authentication paths. When native tooling only lists policies that exist, teams can mistake configuration for enforcement and miss the places where no policy ever applied.
That gap matters most in estates with more provisioned accounts than active users, because exclusions, legacy authentication, and uncovered applications can accumulate quietly. For identity governance, the issue is not whether conditional access is configured, but whether it actually governs the full authentication surface.
Key questions
Q: What breaks when conditional access does not reach every identity and application?
A: The control stops being a reliable enforcement layer and becomes a partial policy. Sign-ins can succeed through uncovered apps, exclusions, or legacy paths without ever triggering the intended challenge. That leaves teams unable to say which authentications were actually governed, which means policy reporting no longer reflects real protection.
Q: Why do legacy authentication protocols create risk after MFA is enabled?
A: Legacy protocols such as IMAP and POP can bypass MFA because they use password-only authentication paths that sit outside modern sign-in enforcement. If those routes remain enabled, an attacker with valid credentials can re-enter the account even after standard remediation. MFA only helps if it covers every access path.
Q: How can teams tell whether conditional access is actually working?
A: Look for consistent enforcement, low rates of contradictory access outcomes, and policy decisions that can be explained quickly during audit or incident review. If the team needs tribal knowledge to interpret the rules, the control may exist on paper but not in practice.
Q: Should organisations treat exclusions as a temporary exception or a control boundary?
A: As a control boundary. Each exclusion removes identities or applications from enforcement, so a growing exception set directly reduces coverage. Teams should review exclusions as part of identity governance, because a large or expanding list often means the actual security boundary is narrower than the policy design suggests.
Technical breakdown
Why conditional access coverage gaps persist
Conditional access evaluation only matters when an authentication request enters the policy engine. If an identity uses a legacy auth path, lands in an exclusion, or reaches an application outside scoped enforcement, the sign-in can succeed without the intended control ever firing. Native consoles often show policy objects and assignments, but not the negative space around them. That means teams can report strong policy design while still leaving broad blind spots in the actual control plane. In practice, coverage is a reach problem, not a rule-writing problem.
Practical implication: measure where policy evaluation never occurs, not just how many policies are configured.
Why exclusion drift weakens MFA enforcement
Exclusions are useful when narrowly targeted, but they become a hidden risk when they expand over time. Each added exception reduces the population that conditional access can govern, and the remaining blind spots are rarely obvious in routine reporting. The article's point is that attackers do not need to defeat MFA if they can authenticate through a path that was never put behind it. That is a governance failure in policy scope, not a failure of MFA logic itself.
Practical implication: review exclusions as scope-reduction events and treat growth in exception lists as a governance signal.
How provisioned identity sprawl masks policy blind spots
When provisioned accounts far outnumber active users, the environment contains more identities than day-to-day administrators can intuitively track. Some of those accounts may be dormant, legacy, service-related, or simply outside current enforcement expectations. That makes conditional access coverage a moving target, especially when applications are added faster than policies are validated against them. The result is a control that appears broad on paper but is narrower in practice than the organisation assumes.
Practical implication: reconcile provisioned identities and application reach before assuming conditional access coverage is complete.
Threat narrative
Attacker objective: The attacker wants to use valid credentials on an authentication path that conditional access never governs, so policy does not block the session.
- Entry occurs when a user authenticates successfully through a legacy path or an application outside conditional access scope, so no policy gate is triggered.
- Escalation follows when a valid password is paired with an ungated authentication route, allowing access without the intended MFA challenge.
- Impact is achieved through persistent access in the blind spot, where the organisation cannot see which identities or applications were never covered.
Breaches seen in the wild
- Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
- Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Coverage, not configuration, is the real conditional access control variable. Policies that exist but do not reach every relevant identity or application create a false sense of enforcement. Abnormal AI's example shows why control counts are a weak proxy for actual protection. The practitioner conclusion is straightforward: governance has to measure scope, not just policy presence.
Exclusion drift is a governance issue before it is a security issue. Every added exclusion narrows the set of authentications conditional access can actually evaluate, and most teams do not track that narrowing as a change in control posture. Over time, the exception list becomes the shadow policy. The practitioner conclusion is to treat exclusions as part of the access model, not as temporary admin convenience.
Legacy authentication preserves the attacker's easiest route. If an application still accepts a path that bypasses MFA, conditional access only protects the routes that modernise first. That makes authentication method inventory a core identity governance task, not an optional hardening exercise. The practitioner conclusion is to map every surviving legacy route as a coverage gap.
Conditional access blind spots become identity blast radius multipliers. When provisioned identities outnumber active users, the number of places where policy can silently fail increases faster than manual review can keep up. That is why coverage needs continuous validation, not periodic reassurance. The practitioner conclusion is to manage the blast radius of uncovered identities as a live control objective.
Coverage assessment must become a continuous identity signal. Native tooling that shows policy objects but not uncovered sign-ins cannot support true control assurance. The missing capability is not another rule, but a view of authenticated activity that never encountered a policy decision. The practitioner conclusion is to treat unseen sign-ins as governance events, not background noise.
What this signals
Conditional access coverage has to be measured as reach, not intent. If native tooling cannot show which authentications never hit a policy decision, then policy design and policy enforcement are being conflated. Identity teams should expect gap analysis to become part of regular governance, especially where provisioned accounts outnumber active users.
Legacy authentication should be treated as an identity governance backlog item. Any surviving auth path that bypasses conditional access preserves a route around MFA and makes coverage reporting less trustworthy. The practical issue is not whether the policy exists, but whether every route that matters is actually inside its scope.
For practitioners
- Measure uncovered authentications Identify which identities authenticated successfully last month without a conditional access policy applied, then map those sign-ins back to the applications and auth paths involved.
- Inventory legacy authentication routes List every application or endpoint that can still authenticate outside modern policy enforcement, especially routes that bypass MFA or rely on older protocols.
- Review exclusion growth Compare the current exclusion set with the last governance review and explain every新增 exception in terms of control scope that was removed.
- Reconcile provisioned and active identities Use the gap between provisioned accounts and active users as a trigger to validate whether dormant, service, or legacy accounts sit outside policy reach.
Key takeaways
- Conditional access can look mature while still leaving important identities, apps, and sign-in routes outside enforcement.
- The operational risk is hidden coverage drift, especially where legacy authentication and exclusions create ungoverned access paths.
- Teams need continuous coverage validation so policy scope matches the real authentication surface, not just the admin console.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article focuses on authentication paths that bypass conditional access and MFA. |
| NHI-08 — Environment Isolation | Coverage gaps arise when applications or identities sit outside the intended policy boundary. | |
| Recommendation — Map uncovered sign-ins to insecure authentication paths and remove routes that bypass policy evaluation. Validate that each application and identity is inside the intended enforcement boundary. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about whether identities and apps are actually authorised under policy scope. |
| Recommendation — Review access authorisations to confirm conditional access reaches every active identity and application. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Legacy auth paths and MFA bypasses are credential and authenticator governance problems. |
| Recommendation — Use authenticator management controls to retire legacy paths that evade MFA enforcement. | ||
| MITRE ATT&CK | TA0006 — Credential Access | Attackers benefit when valid credentials are accepted on paths that avoid authentication gates. |
| Recommendation — Track credential-access activity against uncovered authentication paths and prioritise closure of those routes. | ||
Key terms
- Conditional Access: Conditional access is a policy model that decides whether an action should proceed based on context such as posture, resource sensitivity, timing, and scope. For AI agents, it must be evaluated at request time so a valid credential does not automatically equal permitted behaviour.
- Exclusion Drift: The gradual expansion or persistence of policy exceptions after the original operational reason has changed or disappeared. In IAM, drift turns a narrow exception into a lasting governance gap, shrinking the portion of the environment that a control can truly protect.
- Legacy authentication: Older login or protocol methods that remain in place for compatibility even after stronger controls exist. They often preserve weaker trust assumptions, which makes them attractive to attackers and difficult to defend if they are not tightly scoped and eventually retired.
- Policy Scope: The set of users, services, applications, and sign-in conditions that a control is designed to govern. For conditional access, scope is the practical boundary that determines whether a policy can meaningfully reduce risk or only document intent.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 9, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org