Edit existing conditional access policy from Graph

Question

I created conditional access policy using this from my previous question reply here. It's working as expected.

POST https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies
Content-type: application/json
{

"displayName": "Block access to Application Admins.",
"state": "enabled",
"conditions": {
    "clientAppTypes": [
        "all"
    ],
    "applications": {
        "includeApplications": [
            "appID"
        ]
    },
    "users": {
        "includeRoles": [
            "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3"//ID of Application Admin role
        ]
    }
},
"grantControls": {
    "operator": "OR",
    "builtInControls": [
        "block"
    ]
}
}

I want to change few properties like roles to User administrator and grantControls to allow access with mfa in this existing policy from Graph.

In Portal, we have edit option but is this possible from Graph? How to achieve that?

TIA

Answer 1

I tried to reproduce the same in my environment via Graph Explorer and got below results:

I have one existing conditional access policy with below properties:

To update this policy via Graph API, make use of below query based on your requirement:

PATCH https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies/<id>
Content-type: application/json

{
"displayName": "Require MFA to User Administrators.",
"state": "enabled",
"conditions": {
    "users": {
        "includeRoles": [
            "fe930be7-5e62-47db-91af-98c3a49a38b1"  //ID of User Administrator role
        ]
    }
},
"grantControls": {
    "operator": "OR",
    "builtInControls": [
        "mfa"
    ]
}
}

Response:

When I checked the same in Portal, properties updated successfully like below:

You can get the id of User Administrator role like below:

Go to Azure Portal -> Azure AD -> Roles and administrators -> All roles -> User Administrator

UPDATE:

You can get the id of policy using below query:

GET https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies?$filter=displayName eq 'policyName' &$select=id,displayName

Response: