agent's conditional-access check failed open: missing graph api permission

TL;DR

The agent lacked the Graph permission to read the policy, got an error, and treated it as a pass. Fail closed on check errors, preflight the required permissions, and alert loudly on any check failure.

The query

agent's conditional-access check failed open: missing graph api permission

Use this when

• access checks pass with no data
• Graph permission errors in the log
• the check never denies anyone

Not for

• conditional access policy misconfiguration
• user-facing access denials
• MFA policy design

Steps

1. Find the Graph permission error the check swallowed. Expected output: the missing permission is named.
2. Grant the least-privilege permission the check actually needs. Expected output: the check can read the policy.
3. Change the check to fail closed: any error denies or escalates, never passes. Expected output: errors become visible denials.
4. Add a preflight that verifies permissions before the run starts. Expected output: missing permissions block the run early.
5. Alert on every check failure so silent passes are impossible. Expected output: failures page someone.

Applies to

Microsoft Graph API, Entra ID conditional access, access-check agents.

Variant phrasings

Check passes for some users only

Partial permissions or scoped consent; verify the grant covers all targets.

Permission granted but still fails

Admin consent may be missing; consent explicitly in Entra ID.

Why it happens

Fail-open is the most dangerous default in an access check. A permission error looks like 'no policy applies' unless the code distinguishes error from empty.

Edge cases

• Security checks must fail closed; convenience checks may fail open, but label them.
• Test the check with permissions revoked to see the failure path.
• Review Graph permission grants quarterly; they drift.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_IrbjHcHKSmDOWU5iiqoOIg