Groups assigned to Global Secure Access traffic forwarding profiles should not be nested

Contributed by Christopher BrummAll contributors →

Part of Maester · Entra ID · Global Secure Access · All checks

Run this check

Invoke-Maester -TestId MT.1189 -IncludePreview

Overview

Global Secure Access traffic forwarding profiles (Microsoft 365, Internet, and Private Access) can be scoped to specific users and groups. Microsoft does not support nested group membership for this assignment - a user must be a direct member of the assigned group to receive the profile (and therefore the Global Secure Access client routing). A nested assignment group silently leaves part of the intended population without the profile.

Remediation action:

1. Identify the flagged traffic forwarding profile assignment group(s).
2. Either flatten the group to direct user membership, or assign the nested group(s) to the profile directly.
3. Re-test to confirm that no profile assignment group contains a nested group.

Related links

• Assign users and groups to traffic forwarding profiles
• Global Secure Access traffic forwarding profiles

Details

Every attribute of this check

Field	Value
Test ID	MT.1189
Severity	Medium
Suite	Maester
Product	Entra ID
Feature	Global Secure Access
Area	Access control
Resource type	Group
User impact	Low
Implementation cost	Low
MITRE ATT&CK	None
PowerShell test	Test-MtGsaForwardingProfileAssignmentNotNested
Services	Graph
Compatible licenses	AAD_PREMIUM
Lifecycle	Preview

Source

• Test: tests/maester/global-secure-access/Test.MT.1189.ps1
• Documentation: tests/maester/global-secure-access/Test.MT.1189.md