Entra Private Access applications should be covered by a Conditional Access policy that requires a managed device

Contributed by Christopher BrummAll contributors →

Part of Maester · Entra ID · Global Secure Access · All checks

Run this check

Invoke-Maester -TestId MT.1188 -IncludePreview

Overview

Every Entra Private Access (and Quick Access) application should be protected by an enabled Conditional Access policy that requires a managed device - either by targeting the application directly or via All cloud apps. This ensures private applications are only reachable from managed endpoints.

A policy satisfies the requirement when it grants Require device to be marked as compliant (Intune compliant) or Require Microsoft Entra hybrid joined device (domainJoinedDevice).

This check evaluates application coverage only; it does not evaluate whether the policy applies to every user of the app.

Remediation action

1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
2. Browse to Entra ID > Conditional Access > Policies.
3. Create or edit an enabled policy that targets the listed Private Access applications (or All cloud apps) and, under Grant, requires a compliant or Microsoft Entra hybrid joined device.
4. Set Enable policy to On and save.

Related links

• Apply Conditional Access to Private Access apps
• Require compliant or hybrid joined device

Details

Every attribute of this check

Field	Value
Test ID	MT.1188
Severity	Medium
Suite	Maester
Product	Entra ID
Feature	Global Secure Access
Area	Access control
Resource type	ServicePrincipal
User impact	Medium
Implementation cost	Medium
MITRE ATT&CK	T1078.004 Cloud Accounts, T1133 External Remote Services
Supports controls	nist-800-53-r5:AC-17, nist-800-53-r5:IA-3
PowerShell test	Test-MtGsaPrivateAccessAppCompliantDevice
Services	Graph
Compatible licenses	AAD_PREMIUM
Lifecycle	Preview

Source

• Test: tests/maester/global-secure-access/Test.MT.1188.ps1
• Documentation: tests/maester/global-secure-access/Test.MT.1188.md