Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Azure Active Directory (Azure AD)
  4. API Docs
  5. getAuthenticationStrengthPolicy
Viewing docs for Azure Active Directory (Azure AD) v6.11.1
published on Tuesday, Oct 13, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-azuread

azuread.getAuthenticationStrengthPolicy

azuread logo
Viewing docs for Azure Active Directory (Azure AD) v6.11.1
published on Tuesday, Oct 13, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-azuread

    Use this data source to retrieve information about an authentication strength policy within Azure Active Directory. This can be used to read either the built-in policies supplied by Microsoft, or custom policies created in the tenant.

    API Permissions

    The following API permissions are required in order to use this data source.

    When authenticated with a service principal, this data source requires one of the following application roles: Policy.Read.AuthenticationMethod or Policy.Read.All

    When authenticated with a user principal, this data source requires one of the following directory roles: Conditional Access Administrator, Security Administrator, Security Reader or Global Administrator

    Example Usage

    Look up a built-in policy by display name

    import * as pulumi from "@pulumi/pulumi";
import * as azuread from "@pulumi/azuread";

const example = azuread.getAuthenticationStrengthPolicy({
    displayName: "Multifactor authentication",
});

    import pulumi
import pulumi_azuread as azuread

example = azuread.get_authentication_strength_policy(display_name="Multifactor authentication")

    package main

import (
	"github.com/pulumi/pulumi-azuread/sdk/v6/go/azuread"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := azuread.GetAuthenticationStrengthPolicy(ctx, &azuread.LookupAuthenticationStrengthPolicyArgs{
			DisplayName: pulumi.StringRef("Multifactor authentication"),
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureAD = Pulumi.AzureAD;

return await Deployment.RunAsync(() => 
{
    var example = AzureAD.GetAuthenticationStrengthPolicy.Invoke(new()
    {
        DisplayName = "Multifactor authentication",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azuread.AzureadFunctions;
import com.pulumi.azuread.inputs.GetAuthenticationStrengthPolicyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var example = AzureadFunctions.getAuthenticationStrengthPolicy(GetAuthenticationStrengthPolicyArgs.builder()
            .displayName("Multifactor authentication")
            .build());

    }
}

    variables:
  example:
    fn::invoke:
      function: azuread:getAuthenticationStrengthPolicy
      arguments:
        displayName: Multifactor authentication

    terraform {
  required_providers {
    azuread = {
      source = "pulumi/azuread"
    }
  }
}

data "azuread_authentication_strength_policy" "example" {
  display_name = "Multifactor authentication"
}

    The display names of the built-in policies supplied by Microsoft are:

    • Multifactor authentication
    • Passwordless MFA
    • Phishing-resistant MFA

    Look up a policy by object ID

    import * as pulumi from "@pulumi/pulumi";
import * as azuread from "@pulumi/azuread";

const example = azuread.getAuthenticationStrengthPolicy({
    objectId: "00000000-0000-0000-0000-000000000004",
});

    import pulumi
import pulumi_azuread as azuread

example = azuread.get_authentication_strength_policy(object_id="00000000-0000-0000-0000-000000000004")

    package main

import (
	"github.com/pulumi/pulumi-azuread/sdk/v6/go/azuread"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := azuread.GetAuthenticationStrengthPolicy(ctx, &azuread.LookupAuthenticationStrengthPolicyArgs{
			ObjectId: pulumi.StringRef("00000000-0000-0000-0000-000000000004"),
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureAD = Pulumi.AzureAD;

return await Deployment.RunAsync(() => 
{
    var example = AzureAD.GetAuthenticationStrengthPolicy.Invoke(new()
    {
        ObjectId = "00000000-0000-0000-0000-000000000004",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azuread.AzureadFunctions;
import com.pulumi.azuread.inputs.GetAuthenticationStrengthPolicyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var example = AzureadFunctions.getAuthenticationStrengthPolicy(GetAuthenticationStrengthPolicyArgs.builder()
            .objectId("00000000-0000-0000-0000-000000000004")
            .build());

    }
}

    variables:
  example:
    fn::invoke:
      function: azuread:getAuthenticationStrengthPolicy
      arguments:
        objectId: 00000000-0000-0000-0000-000000000004

    terraform {
  required_providers {
    azuread = {
      source = "pulumi/azuread"
    }
  }
}

data "azuread_authentication_strength_policy" "example" {
  object_id = "00000000-0000-0000-0000-000000000004"
}

    Look up a policy managed elsewhere in the same configuration

    import * as pulumi from "@pulumi/pulumi";
import * as azuread from "@pulumi/azuread";

const example = azuread.getAuthenticationStrengthPolicy({
    objectId: exampleAzureadAuthenticationStrengthPolicy.objectId,
});

    import pulumi
import pulumi_azuread as azuread

example = azuread.get_authentication_strength_policy(object_id=example_azuread_authentication_strength_policy["objectId"])

    package main

import (
	"github.com/pulumi/pulumi-azuread/sdk/v6/go/azuread"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := azuread.GetAuthenticationStrengthPolicy(ctx, &azuread.LookupAuthenticationStrengthPolicyArgs{
			ObjectId: pulumi.StringRef(exampleAzureadAuthenticationStrengthPolicy.ObjectId),
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureAD = Pulumi.AzureAD;

return await Deployment.RunAsync(() => 
{
    var example = AzureAD.GetAuthenticationStrengthPolicy.Invoke(new()
    {
        ObjectId = exampleAzureadAuthenticationStrengthPolicy.ObjectId,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azuread.AzureadFunctions;
import com.pulumi.azuread.inputs.GetAuthenticationStrengthPolicyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var example = AzureadFunctions.getAuthenticationStrengthPolicy(GetAuthenticationStrengthPolicyArgs.builder()
            .objectId(exampleAzureadAuthenticationStrengthPolicy.get("objectId"))
            .build());

    }
}

    variables:
  example:
    fn::invoke:
      function: azuread:getAuthenticationStrengthPolicy
      arguments:
        objectId: ${exampleAzureadAuthenticationStrengthPolicy.objectId}

    terraform {
  required_providers {
    azuread = {
      source = "pulumi/azuread"
    }
  }
}

data "azuread_authentication_strength_policy" "example" {
  object_id = exampleAzureadAuthenticationStrengthPolicy.objectId
}

    Using getAuthenticationStrengthPolicy

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getAuthenticationStrengthPolicy(args: GetAuthenticationStrengthPolicyArgs, opts?: InvokeOptions): Promise<GetAuthenticationStrengthPolicyResult>
function getAuthenticationStrengthPolicyOutput(args: GetAuthenticationStrengthPolicyOutputArgs, opts?: InvokeOutputOptions): Output<GetAuthenticationStrengthPolicyResult>
    def get_authentication_strength_policy(display_name: Optional[str] = None,
                                       object_id: Optional[str] = None,
                                       opts: Optional[InvokeOptions] = None) -> GetAuthenticationStrengthPolicyResult
def get_authentication_strength_policy_output(display_name: pulumi.Input[Optional[str]] = None,
                                       object_id: pulumi.Input[Optional[str]] = None,
                                       opts: Optional[InvokeOutputOptions] = None) -> Output[GetAuthenticationStrengthPolicyResult]
    func LookupAuthenticationStrengthPolicy(ctx *Context, args *LookupAuthenticationStrengthPolicyArgs, opts ...InvokeOption) (*LookupAuthenticationStrengthPolicyResult, error)
func LookupAuthenticationStrengthPolicyOutput(ctx *Context, args *LookupAuthenticationStrengthPolicyOutputArgs, opts ...InvokeOption) LookupAuthenticationStrengthPolicyResultOutput

    > Note: This function is named LookupAuthenticationStrengthPolicy in the Go SDK.

    public static class GetAuthenticationStrengthPolicy 
{
    public static Task<GetAuthenticationStrengthPolicyResult> InvokeAsync(GetAuthenticationStrengthPolicyArgs args, InvokeOptions? opts = null)
    public static Output<GetAuthenticationStrengthPolicyResult> Invoke(GetAuthenticationStrengthPolicyInvokeArgs args, InvokeOptions? opts = null)
    public static Output<GetAuthenticationStrengthPolicyResult> Invoke(GetAuthenticationStrengthPolicyInvokeArgs args, InvokeOutputOptions opts)
}
    public static CompletableFuture<GetAuthenticationStrengthPolicyResult> getAuthenticationStrengthPolicy(GetAuthenticationStrengthPolicyArgs args, InvokeOptions options)
public static Output<GetAuthenticationStrengthPolicyResult> getAuthenticationStrengthPolicy(GetAuthenticationStrengthPolicyArgs args, InvokeOptions options)
public static Output<GetAuthenticationStrengthPolicyResult> getAuthenticationStrengthPolicy(GetAuthenticationStrengthPolicyArgs args, InvokeOutputOptions options)

    fn::invoke:
  function: azuread:index/getAuthenticationStrengthPolicy:getAuthenticationStrengthPolicy
  arguments:
    # arguments dictionary
    data "azuread_get_authentication_strength_policy" "name" {
    # arguments
}

    The following arguments are supported:

    DisplayName string
    The display name of the authentication strength policy.
    ObjectId string

    The object ID of the authentication strength policy.

    One of displayName or objectId must be specified.

    Tip Display names are expected to be unique within a tenant, however this is not guaranteed by the API. Specify objectId where you need to be certain of matching a specific policy.

    DisplayName string
    The display name of the authentication strength policy.
    ObjectId string

    The object ID of the authentication strength policy.

    One of displayName or objectId must be specified.

    Tip Display names are expected to be unique within a tenant, however this is not guaranteed by the API. Specify objectId where you need to be certain of matching a specific policy.

    display_name string
    The display name of the authentication strength policy.
    object_id string

    The object ID of the authentication strength policy.

    One of displayName or objectId must be specified.

    Tip Display names are expected to be unique within a tenant, however this is not guaranteed by the API. Specify objectId where you need to be certain of matching a specific policy.

    displayName String
    The display name of the authentication strength policy.
    objectId String

    The object ID of the authentication strength policy.

    One of displayName or objectId must be specified.

    Tip Display names are expected to be unique within a tenant, however this is not guaranteed by the API. Specify objectId where you need to be certain of matching a specific policy.

    displayName string
    The display name of the authentication strength policy.
    objectId string

    The object ID of the authentication strength policy.

    One of displayName or objectId must be specified.

    Tip Display names are expected to be unique within a tenant, however this is not guaranteed by the API. Specify objectId where you need to be certain of matching a specific policy.

    display_name str
    The display name of the authentication strength policy.
    object_id str

    The object ID of the authentication strength policy.

    One of displayName or objectId must be specified.

    Tip Display names are expected to be unique within a tenant, however this is not guaranteed by the API. Specify objectId where you need to be certain of matching a specific policy.

    displayName String
    The display name of the authentication strength policy.
    objectId String

    The object ID of the authentication strength policy.

    One of displayName or objectId must be specified.

    Tip Display names are expected to be unique within a tenant, however this is not guaranteed by the API. Specify objectId where you need to be certain of matching a specific policy.

    getAuthenticationStrengthPolicy Result

    The following output properties are available:

    AllowedCombinations List<string>
    A list of allowed authentication methods combinations for this authentication strength policy.
    CombinationConfigurations List<Pulumi.AzureAD.Outputs.GetAuthenticationStrengthPolicyCombinationConfiguration>
    A list of combinationConfigurations blocks as documented below, which further constrain the allowed combinations for this policy.
    Description string
    The description of this authentication strength policy.
    DisplayName string
    The display name of this authentication strength policy.
    Id string
    The provider-assigned unique ID for this managed resource.
    ObjectId string
    The object ID of this combination configuration.
    AllowedCombinations []string
    A list of allowed authentication methods combinations for this authentication strength policy.
    CombinationConfigurations []GetAuthenticationStrengthPolicyCombinationConfiguration
    A list of combinationConfigurations blocks as documented below, which further constrain the allowed combinations for this policy.
    Description string
    The description of this authentication strength policy.
    DisplayName string
    The display name of this authentication strength policy.
    Id string
    The provider-assigned unique ID for this managed resource.
    ObjectId string
    The object ID of this combination configuration.
    allowed_combinations list(string)
    A list of allowed authentication methods combinations for this authentication strength policy.
    combination_configurations list(object)
    A list of combinationConfigurations blocks as documented below, which further constrain the allowed combinations for this policy.
    description string
    The description of this authentication strength policy.
    display_name string
    The display name of this authentication strength policy.
    id string
    The provider-assigned unique ID for this managed resource.
    object_id string
    The object ID of this combination configuration.
    allowedCombinations List<String>
    A list of allowed authentication methods combinations for this authentication strength policy.
    combinationConfigurations List<GetAuthenticationStrengthPolicyCombinationConfiguration>
    A list of combinationConfigurations blocks as documented below, which further constrain the allowed combinations for this policy.
    description String
    The description of this authentication strength policy.
    displayName String
    The display name of this authentication strength policy.
    id String
    The provider-assigned unique ID for this managed resource.
    objectId String
    The object ID of this combination configuration.
    allowedCombinations string[]
    A list of allowed authentication methods combinations for this authentication strength policy.
    combinationConfigurations GetAuthenticationStrengthPolicyCombinationConfiguration[]
    A list of combinationConfigurations blocks as documented below, which further constrain the allowed combinations for this policy.
    description string
    The description of this authentication strength policy.
    displayName string
    The display name of this authentication strength policy.
    id string
    The provider-assigned unique ID for this managed resource.
    objectId string
    The object ID of this combination configuration.
    allowed_combinations Sequence[str]
    A list of allowed authentication methods combinations for this authentication strength policy.
    combination_configurations Sequence[GetAuthenticationStrengthPolicyCombinationConfiguration]
    A list of combinationConfigurations blocks as documented below, which further constrain the allowed combinations for this policy.
    description str
    The description of this authentication strength policy.
    display_name str
    The display name of this authentication strength policy.
    id str
    The provider-assigned unique ID for this managed resource.
    object_id str
    The object ID of this combination configuration.
    allowedCombinations List<String>
    A list of allowed authentication methods combinations for this authentication strength policy.
    combinationConfigurations List<Property Map>
    A list of combinationConfigurations blocks as documented below, which further constrain the allowed combinations for this policy.
    description String
    The description of this authentication strength policy.
    displayName String
    The display name of this authentication strength policy.
    id String
    The provider-assigned unique ID for this managed resource.
    objectId String
    The object ID of this combination configuration.

    Supporting Types

    GetAuthenticationStrengthPolicyCombinationConfiguration

    AllowedAaguids List<string>
    A list of AAGUIDs allowed by this combination configuration. Only populated when type is fido2CombinationConfiguration.
    AllowedIssuerSkis List<string>
    A list of allowed certificate issuer subject key identifier values. Only populated when type is x509CertificateCombinationConfiguration.
    AllowedPolicyOids List<string>
    A list of allowed certificate policy OIDs. Only populated when type is x509CertificateCombinationConfiguration.
    AppliesToCombinations List<string>
    A list of authentication method combinations this configuration applies to, for example fido2 or x509CertificateSingleFactor. This is distinct from type, which identifies the kind of combination configuration.
    ObjectId string

    The object ID of the authentication strength policy.

    One of displayName or objectId must be specified.

    Tip Display names are expected to be unique within a tenant, however this is not guaranteed by the API. Specify objectId where you need to be certain of matching a specific policy.

    Type string
    The type of this combination configuration, either fido2CombinationConfiguration or x509CertificateCombinationConfiguration.
    AllowedAaguids []string
    A list of AAGUIDs allowed by this combination configuration. Only populated when type is fido2CombinationConfiguration.
    AllowedIssuerSkis []string
    A list of allowed certificate issuer subject key identifier values. Only populated when type is x509CertificateCombinationConfiguration.
    AllowedPolicyOids []string
    A list of allowed certificate policy OIDs. Only populated when type is x509CertificateCombinationConfiguration.
    AppliesToCombinations []string
    A list of authentication method combinations this configuration applies to, for example fido2 or x509CertificateSingleFactor. This is distinct from type, which identifies the kind of combination configuration.
    ObjectId string

    The object ID of the authentication strength policy.

    One of displayName or objectId must be specified.

    Tip Display names are expected to be unique within a tenant, however this is not guaranteed by the API. Specify objectId where you need to be certain of matching a specific policy.

    Type string
    The type of this combination configuration, either fido2CombinationConfiguration or x509CertificateCombinationConfiguration.
    allowed_aaguids list(string)
    A list of AAGUIDs allowed by this combination configuration. Only populated when type is fido2CombinationConfiguration.
    allowed_issuer_skis list(string)
    A list of allowed certificate issuer subject key identifier values. Only populated when type is x509CertificateCombinationConfiguration.
    allowed_policy_oids list(string)
    A list of allowed certificate policy OIDs. Only populated when type is x509CertificateCombinationConfiguration.
    applies_to_combinations list(string)
    A list of authentication method combinations this configuration applies to, for example fido2 or x509CertificateSingleFactor. This is distinct from type, which identifies the kind of combination configuration.
    object_id string

    The object ID of the authentication strength policy.

    One of displayName or objectId must be specified.

    Tip Display names are expected to be unique within a tenant, however this is not guaranteed by the API. Specify objectId where you need to be certain of matching a specific policy.

    type string
    The type of this combination configuration, either fido2CombinationConfiguration or x509CertificateCombinationConfiguration.
    allowedAaguids List<String>
    A list of AAGUIDs allowed by this combination configuration. Only populated when type is fido2CombinationConfiguration.
    allowedIssuerSkis List<String>
    A list of allowed certificate issuer subject key identifier values. Only populated when type is x509CertificateCombinationConfiguration.
    allowedPolicyOids List<String>
    A list of allowed certificate policy OIDs. Only populated when type is x509CertificateCombinationConfiguration.
    appliesToCombinations List<String>
    A list of authentication method combinations this configuration applies to, for example fido2 or x509CertificateSingleFactor. This is distinct from type, which identifies the kind of combination configuration.
    objectId String

    The object ID of the authentication strength policy.

    One of displayName or objectId must be specified.

    Tip Display names are expected to be unique within a tenant, however this is not guaranteed by the API. Specify objectId where you need to be certain of matching a specific policy.

    type String
    The type of this combination configuration, either fido2CombinationConfiguration or x509CertificateCombinationConfiguration.
    allowedAaguids string[]
    A list of AAGUIDs allowed by this combination configuration. Only populated when type is fido2CombinationConfiguration.
    allowedIssuerSkis string[]
    A list of allowed certificate issuer subject key identifier values. Only populated when type is x509CertificateCombinationConfiguration.
    allowedPolicyOids string[]
    A list of allowed certificate policy OIDs. Only populated when type is x509CertificateCombinationConfiguration.
    appliesToCombinations string[]
    A list of authentication method combinations this configuration applies to, for example fido2 or x509CertificateSingleFactor. This is distinct from type, which identifies the kind of combination configuration.
    objectId string

    The object ID of the authentication strength policy.

    One of displayName or objectId must be specified.

    Tip Display names are expected to be unique within a tenant, however this is not guaranteed by the API. Specify objectId where you need to be certain of matching a specific policy.

    type string
    The type of this combination configuration, either fido2CombinationConfiguration or x509CertificateCombinationConfiguration.
    allowed_aaguids Sequence[str]
    A list of AAGUIDs allowed by this combination configuration. Only populated when type is fido2CombinationConfiguration.
    allowed_issuer_skis Sequence[str]
    A list of allowed certificate issuer subject key identifier values. Only populated when type is x509CertificateCombinationConfiguration.
    allowed_policy_oids Sequence[str]
    A list of allowed certificate policy OIDs. Only populated when type is x509CertificateCombinationConfiguration.
    applies_to_combinations Sequence[str]
    A list of authentication method combinations this configuration applies to, for example fido2 or x509CertificateSingleFactor. This is distinct from type, which identifies the kind of combination configuration.
    object_id str

    The object ID of the authentication strength policy.

    One of displayName or objectId must be specified.

    Tip Display names are expected to be unique within a tenant, however this is not guaranteed by the API. Specify objectId where you need to be certain of matching a specific policy.

    type str
    The type of this combination configuration, either fido2CombinationConfiguration or x509CertificateCombinationConfiguration.
    allowedAaguids List<String>
    A list of AAGUIDs allowed by this combination configuration. Only populated when type is fido2CombinationConfiguration.
    allowedIssuerSkis List<String>
    A list of allowed certificate issuer subject key identifier values. Only populated when type is x509CertificateCombinationConfiguration.
    allowedPolicyOids List<String>
    A list of allowed certificate policy OIDs. Only populated when type is x509CertificateCombinationConfiguration.
    appliesToCombinations List<String>
    A list of authentication method combinations this configuration applies to, for example fido2 or x509CertificateSingleFactor. This is distinct from type, which identifies the kind of combination configuration.
    objectId String

    The object ID of the authentication strength policy.

    One of displayName or objectId must be specified.

    Tip Display names are expected to be unique within a tenant, however this is not guaranteed by the API. Specify objectId where you need to be certain of matching a specific policy.

    type String
    The type of this combination configuration, either fido2CombinationConfiguration or x509CertificateCombinationConfiguration.

    Package Details

    Repository
    Azure Active Directory (Azure AD) pulumi/pulumi-azuread
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the azuread Terraform Provider.
    azuread logo
    Viewing docs for Azure Active Directory (Azure AD) v6.11.1
    published on Tuesday, Oct 13, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-azuread

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial