🔧 New: User Management Graph PowerShell Toolkit
Simplify user tasks like bulk creation, updates, password resets, deletions, license checks & more — all from one place.
🚀 Launch ToolkitGet-MgPolicyAuthorizationPolicy Cmdlet Guide
The Get-MgPolicyAuthorizationPolicy cmdlet is part of the Microsoft Graph PowerShell SDK. It allows administrators to retrieve the Authorization Policy in Microsoft Entra ID (formerly Azure Active Directory). This policy governs critical organizational security behaviors, such as self-service sign-up for external users, app consent, and invitation permissions.
Cmdlet Syntax
Get-MgPolicyAuthorizationPolicyThis cmdlet requires no parameters and returns the single authorization policy object for the tenant.
Usage Examples
Example 1: Retrieve the Authorization Policy
Get-MgPolicyAuthorizationPolicyDescription: Fetches the current authorization policy for the organization.
Example 2: View Specific Properties Only
Get-MgPolicyAuthorizationPolicy | Select-Object Id, AllowInvitesFrom, AllowUserConsentForAppsDescription: Displays a filtered view of the most relevant settings from the policy.
Example 3: Export Authorization Policy to JSON File
Get-MgPolicyAuthorizationPolicy | ConvertTo-Json | Out-File -FilePath "AuthPolicyBackup.json"Description: Creates a backup of the current authorization policy in JSON format.
Cmdlet Tips
Here are some ways to extend this script:
- Connect First: Always run Connect-MgGraph before calling this cmdlet.
- Check Your Permissions: You need either Policy.Read.All or Policy.ReadWrite.Authorization permissions (depending on read-only or edit access).
- One Policy Only: There is only one AuthorizationPolicy per directory, so no additional filtering or -Id is required.
- Use Piping: Combine with Select-Object or ConvertTo-Json to format output as needed.
Frequently Asked Questions
- What does the Get-MgPolicyAuthorizationPolicy cmdlet do?
- Can there be multiple authorization policies in a tenant?
- Do I need special permissions to use Get-MgPolicyAuthorizationPolicy?
- How can I audit changes made to the authorization policy?
This cmdlet retrieves your tenant’s authorization policy, which defines rules for user consent, default user role permissions, and behavior related to guest access within Microsoft 365.
No. Each tenant has a single, global authorization policy. The same policy applies across all applications and users unless explicitly overridden through other administrative configurations.
Yes. You must have one of the following delegated or application permissions: Policy.Read.All or Policy.ReadWrite.Authorization in Microsoft Graph.
You can periodically export the policy output using:
Get-MgPolicyAuthorizationPolicy | ConvertTo-Json | Out-File "AuthPolicyBackup.json"Then compare snapshots over time to identify modifications and ensure policy integrity.
Possible Errors & Solutions
| Error | Cause | Solution |
| Access Denied | Insufficient permissions | Ensure you have Policy.Read.All or higher permission |
| Connect-MgGraph not run | Not authenticated | Run Connect-MgGraph and sign in as a global admin or policy admin |
| The term 'Get-MgPolicyAuthorizationPolicy' is not recognized | Module not installed | Run Install-Module Microsoft.Graph first |
Use Cases
This script is extremely useful for:
- Review External User Settings
- Monitor App Consent Settings
- Delegate Invite Permissions
- Automate Policy Backups
Quickly check if external users can join the organization via email verification or invitations.
(Get-MgPolicyAuthorizationPolicy).AllowEmailVerifiedUsersToJoinOrganization
Determine whether users can consent to third-party apps on behalf of the organization.
(Get-MgPolicyAuthorizationPolicy).AllowUserConsentForApps
Check who is allowed to invite guests — only admins, members, or none.
(Get-MgPolicyAuthorizationPolicy).AllowInvitesFrom
Create scheduled exports of your organization’s authorization policy to track changes over time.
The
authorizationPolicy object retrieved by Get-MgPolicyAuthorizationPolicy is unique — each tenant has exactly one instance. You don’t need to provide an ID or filter; simply run the cmdlet to fetch the full policy.
After retrieving the policy, export it to JSON or CSV for change tracking. For example:
Get-MgPolicyAuthorizationPolicy | ConvertTo-Json | Out-File "AuthPolicyBackup.json"This makes it easier to spot unauthorized changes over time and maintain configuration integrity.
Conclusion
The Get-MgPolicyAuthorizationPolicy cmdlet is a must-know tool for Microsoft Entra administrators. It provides visibility into critical organizational policies that govern guest access, application permissions, and user-driven actions. Whether you're auditing current settings, preparing for a security review, or automating policy backups, this cmdlet offers a secure and efficient entry point.