Skip to main content
Version: 2.1.0

Test-MtGsaPrivateAccessAppAssignmentNotNested

SYNOPSIS​

Checks if groups assigned to Entra Private Access (and Quick Access) applications use direct membership (no nested groups).

SYNTAX​

Test-MtGsaPrivateAccessAppAssignmentNotNested [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION​

Microsoft Entra enterprise application assignment grants access to the direct (and dynamic) members of an assigned group only - the assignment does not cascade to nested groups, and nested group membership is not supported for app assignment. Groups assigned to Global Secure Access Private Access applications (and the Quick Access app) must therefore use direct membership, otherwise members of a nested group are silently left without access.

Note: this only applies to app assignment (appRoleAssignedTo). Conditional Access scoping does honor nested groups, so the MFA and managed-device coverage checks are not affected.

EXAMPLES​

EXAMPLE 1​

Test-MtGsaPrivateAccessAppAssignmentNotNested

Returns $true if no group assigned to a Private Access or Quick Access application contains a nested group.

PARAMETERS​

-ProgressAction​

Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

System.Boolean​

NOTES​

https://maester.dev/docs/commands/Test-MtGsaPrivateAccessAppAssignmentNotNested