Skip to main content
Version: 2.1.1-preview

MT.1190 - Entra Private Access applications should not use the Default connector group

Christopher Brumm
Contributed by Christopher BrummAll contributors →

Overview​

Newly installed Microsoft Entra private network connectors automatically join the Default connector group. If an Entra Private Access application is served by the Default group, a freshly installed or misconfigured connector immediately begins handling its traffic - a routing and outage risk. Keep the Default group as an idle / onboarding pool and serve every Private Access application through a dedicated connector group.

Remediation action:​

  1. Sign in to the Microsoft Entra admin center as at least a Global Secure Access Administrator.
  2. Browse to Global Secure Access > Applications > Enterprise applications and open each flagged application.
  3. Reassign it from the Default connector group to a dedicated connector group.

Test Metadata​

FieldValue
Test IDMT.1190
SeverityUnknown
SuiteMaester
CategoryEntra
PowerShell testTest-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup
TagsEntra, Maester, MT.1190, Preview

Source​

  • Pester test: tests/Maester/GlobalSecureAccess/Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup.Tests.ps1
  • PowerShell source: powershell/public/maester/globalsecureaccess/Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup.ps1