New-MgIdentityConditionalAccessPolicy : 1007: Incoming ConditionalAccessPolicy object is null or does not match the schema of ConditionalAccessPolicy type

I've ended up solving this problem myself using the Microsoft.Entra Powershell module instead. Which suggests there's either a problem with the graph powershell module or its documentation.

The below worked fine using Microsoft.Entra.Signins module:

#Create policy
Import-Module Microsoft.Entra.Signins
$conditions = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessConditionSet
$conditions.Applications = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessApplicationCondition
$conditions.Applications.IncludeApplications = "All"
$conditions.Users = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessUserCondition
$conditions.Users.IncludeUsers = "All"
$conditions.Users.ExcludeGroups = @($GuestGroup.Id,$RoamingGroup.Id)
$conditions.Locations = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessLocationCondition
$conditions.Locations.IncludeLocations = "All"
$conditions.Locations.ExcludeLocations = $AusLocation.Id
$conditions.ClientAppTypes = @("ExchangeActiveSync","Browser","MobileAppsAndDesktopClients","Other")
$controls = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessGrantControls
$controls._Operator = "OR"
$controls.BuiltInControls = "Block"

New-EntraConditionalAccessPolicy -DisplayName "International Roaming" -State "enabled" -Conditions $conditions -GrantControls $controls

The error message you're encountering, New-MgIdentityConditionalAccessPolicy : 1007: Incoming ConditionalAccessPolicy object is null or does not match the schema of ConditionalAccessPolicy type, indicates that the JSON body you are sending does not conform to the expected schema for a Conditional Access Policy.

Here are a few things you can check and adjust in your JSON body:

1. Grant Controls: Ensure that the grantControls section is structured correctly. The builtInControls should be an array of valid values. For example, ensure that "Block" is a valid built-in control in your context.
2. Conditions Structure: The conditions object should include all required fields. Make sure that the grantControls, clientAppTypes, applications, locations, and users sections are all correctly formatted and contain valid values.
3. Application Types: Verify that the clientAppTypes values you are using are valid. The expected values are typically predefined, such as all, browser, mobileAppsAndDesktopClients, etc.
4. User and Group IDs: Check that the IDs you are using in excludeGroups and includeUsers are valid and exist in your directory.
5. State Value: Ensure that the state value is acceptable. It should typically be either "enabled" or "disabled".
6. Debugging: You can also try simplifying your JSON body by removing optional fields or using only required fields to see if the error persists. This can help isolate which part of the body is causing the issue.

Here’s a simplified example of what a valid body might look like:

{
  "displayName": "International Roaming",
  "state": "disabled",
  "conditions": {
    "grantControls": {
      "builtInControls": ["block"],
      "operator": "OR"
    },
    "clientAppTypes": ["all"],
    "applications": {
      "includeApplications": ["All"]
    },
    "locations": {
      "excludeLocations": ["15cf0a01-b127-4acc-a3b4-0b737e83b171"],
      "includeLocations": ["All"]
    },
    "users": {
      "excludeGroups": ["d4ee09af-97c9-4630-b35b-e58a4cdf7059"],
      "includeUsers": ["All"]
    }
  }
}

Make sure to adjust your body according to the schema requirements and validate each part of the JSON structure against the expected schema for Conditional Access Policies.