<#
    .SYNOPSIS
    Export-CAPolicies.ps1

    .DESCRIPTION
    Export Conditional Access policies to JSON files for backup purposes.

    .LINK
    www.alitajran.com/export-conditional-access-policies/

    .NOTES
    Written by: ALI TAJRAN
    Website:    www.alitajran.com
    LinkedIn:   linkedin.com/in/alitajran

    .CHANGELOG
    V1.00, 11/16/2023 - Initial version
    V1.10, 03/23/2026 - Skip Microsoft-managed policies on export
#>

# Connect to Microsoft Graph API
Connect-MgGraph -Scopes 'Policy.Read.All' -NoWelcome

# Export path for CA policies
$ExportPath = "C:\temp"

try {
    # Retrieve all conditional access policies from Microsoft Graph API
    $AllPolicies = Get-MgIdentityConditionalAccessPolicy -All

    if ($AllPolicies.Count -eq 0) {
        Write-Host "There are no CA policies found to export." -ForegroundColor Yellow
    }
    else {
        # Iterate through each policy
        foreach ($Policy in $AllPolicies) {
            try {
                # Skip Microsoft-managed policies
                if ($Policy.DisplayName -like 'Microsoft-managed:*') {
                    Write-Host "Skipped Microsoft-managed policy: $($Policy.DisplayName)" -ForegroundColor Cyan
                    continue
                }
                $PolicyName = $Policy.DisplayName -replace '[\\/:*?"<>|]', ''
                $PolicyJSON = $Policy | ConvertTo-Json -Depth 6
                $PolicyJSON | Out-File "$ExportPath\$PolicyName.json" -Force
                Write-Host "Successfully backed up CA policy: $($Policy.DisplayName)" -ForegroundColor Green
            }
            catch {
                Write-Host "Error occurred while backing up CA policy: $($Policy.DisplayName). $($_.Exception.Message)" -ForegroundColor Red
            }
        }
    }
}
catch {
    Write-Host "Error occurred: $($_.Exception.Message)" -ForegroundColor Red
}