The Quick Access app should not be subject to a sign-in frequency Conditional Access control
Part of Maester · Entra ID · Global Secure Access · All checks
Invoke-Maester -TestId MT.1195 -IncludePreviewOverview
Section titled “Overview”When Private DNS is hosted on the Quick Access application, the Global Secure Access client’s DNS queries authenticate against the Quick Access app and are evaluated by Conditional Access. A sign-in frequency session control then re-triggers on those frequent DNS lookups, causing unexpected and repeated authentication prompts. Microsoft recommends not applying a sign-in frequency control to Quick Access.
This is an operational / user-experience hygiene check, not a security gap. The fix is to exclude the Quick Access app from the sign-in frequency policy - the MFA grant and the control for everything else stay in place.
An enabled sign-in frequency policy that targets Quick Access is a Fail, unless it falls into a category that does not drive routine DNS prompts, which is surfaced for Review instead:
- Role-only - scoped only to directory roles (e.g. admins), who typically do not use Private Access.
- Guest - scoped to guest / external users, who very rarely use Private Access.
- Risk-gated - has a user- or sign-in-risk condition, so the control only applies under elevated risk.
- Browser - limited to the
browserclient app type; Private Access / Quick Access traffic is not browser-based.
Reviewed, accepted exceptions can be allow-listed by policy id or display name via the GsaQuickAccessSignInFrequencyAllowedPolicies global setting in maester-config.json; those are reported as Accepted and never fail.
Remediation action
Section titled “Remediation action”- Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
- Browse to Entra ID > Conditional Access > Policies and open each Fail policy.
- Under Target resources, exclude the Quick Access application (do not remove the sign-in frequency control organization-wide).
Related links
Section titled “Related links”- Apply Conditional Access to Private Access apps
- Conditional Access session controls - sign-in frequency
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | MT.1195 |
| Severity | Low |
| Suite | Maester |
| Product | Entra ID |
| Feature | Global Secure Access |
| Area | Authentication |
| Resource type | ConditionalAccessPolicy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtGsaQuickAccessNoSignInFrequency |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
| Lifecycle | Preview |