The baseline Global Secure Access security profile should enforce a threat-intelligence floor

Contributed by Christopher BrummAll contributors →

Part of Maester · Entra ID · Global Secure Access · All checks

Run this check

Invoke-Maester -TestId MT.1194 -IncludePreview

Overview

The baseline security profile (priority 65000) applies to all Internet Access traffic with no Conditional Access required. Linking an enabled threat-intelligence policy to the baseline provides an always-on malware and phishing floor.

The baseline is the only place that protects non-client / remote-network traffic, the Conditional Access token-propagation gap, and users not matched by any user-aware (CA-linked) profile. Microsoft recommends linking the threat-intelligence policy to the baseline because it applies to all users’ traffic.

Remediation action:

1. Sign in to the Microsoft Entra admin center as at least a Global Secure Access Administrator.
2. Browse to Global Secure Access > Secure > Threat intelligence policies and create or enable a policy.
3. Link the threat-intelligence policy to the baseline security profile.

Related links

• Global Secure Access threat intelligence
• Global Secure Access security profiles

Details

Every attribute of this check

Field	Value
Test ID	MT.1194
Severity	Medium
Suite	Maester
Product	Entra ID
Feature	Global Secure Access
Area	Access control
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1204.001 Malicious Link, T1566.002 Spearphishing Link
PowerShell test	Test-MtGsaBaselineThreatIntelligenceEnforced
Services	Graph
Compatible licenses	AAD_PREMIUM
Lifecycle	Preview

Source

• Test: tests/maester/global-secure-access/Test.MT.1194.ps1
• Documentation: tests/maester/global-secure-access/Test.MT.1194.md