Entra Private Access applications should not use the Default connector group

Contributed by Christopher BrummAll contributors →

Part of Maester · Entra ID · Global Secure Access · All checks

Run this check

Invoke-Maester -TestId MT.1190 -IncludePreview

Overview

Newly installed Microsoft Entra private network connectors automatically join the Default connector group. If an Entra Private Access application is served by the Default group, a freshly installed or misconfigured connector immediately begins handling its traffic - a routing and outage risk. Keep the Default group as an idle / onboarding pool and serve every Private Access application through a dedicated connector group.

Remediation action:

1. Sign in to the Microsoft Entra admin center as at least a Global Secure Access Administrator.
2. Browse to Global Secure Access > Applications > Enterprise applications and open each flagged application.
3. Reassign it from the Default connector group to a dedicated connector group.

Related links

• Microsoft Entra private network connector groups
• Publish Enterprise apps with Global Secure Access

Details

Every attribute of this check

Field	Value
Test ID	MT.1190
Severity	Low
Suite	Maester
Product	Entra ID
Feature	Global Secure Access
Area	Infrastructure hardening
Resource type	ServicePrincipal
User impact	Low
Implementation cost	Low
MITRE ATT&CK	None
PowerShell test	Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup
Services	Graph
Compatible licenses	AAD_PREMIUM
Lifecycle	Preview

Source

• Test: tests/maester/global-secure-access/Test.MT.1190.ps1
• Documentation: tests/maester/global-secure-access/Test.MT.1190.md