Skip to main content
Version: 2.1.1-preview

MT.1188 - Entra Private Access applications should be covered by a Conditional Access policy that requires a managed device

Overviewā€‹

Every Entra Private Access (and Quick Access) application should be protected by an enabled Conditional Access policy that requires a managed device - either by targeting the application directly or via All cloud apps. This ensures private applications are only reachable from managed endpoints.

A policy satisfies the requirement when it grants Require device to be marked as compliant (Intune compliant) or Require Microsoft Entra hybrid joined device (domainJoinedDevice).

This check evaluates application coverage only; it does not evaluate whether the policy applies to every user of the app.

Remediation action:ā€‹

  1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
  2. Browse to Entra ID > Conditional Access > Policies.
  3. Create or edit an enabled policy that targets the listed Private Access applications (or All cloud apps) and, under Grant, requires a compliant or Microsoft Entra hybrid joined device.
  4. Set Enable policy to On and save.

Test Metadataā€‹

FieldValue
Test IDMT.1188
SeverityUnknown
SuiteMaester
CategoryEntra
PowerShell testTest-MtGsaPrivateAccessAppCompliantDevice
TagsCA, Entra, Maester, MT.1188, Preview

Sourceā€‹

  • Pester test: tests/Maester/GlobalSecureAccess/Test-MtGsaPrivateAccessAppCompliantDevice.Tests.ps1
  • PowerShell source: powershell/public/maester/globalsecureaccess/Test-MtGsaPrivateAccessAppCompliantDevice.ps1