# Groups assigned to Global Secure Access traffic forwarding profiles should not be nested

Global Secure Access traffic forwarding profiles (Microsoft 365, Internet, and Private Access) can be scoped to specific users and groups.

Source: https://maester.dev/docs/tests/MT.1189

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/crmhh" title="Christopher Brumm · Original author"><img src="https://github.com/crmhh.png" alt="Christopher Brumm" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/crmhh">Christopher Brumm</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Entra ID · Global Secure Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1189 -IncludePreview
```

## Overview

Global Secure Access traffic forwarding profiles (Microsoft 365, Internet, and Private Access) can be scoped to specific users and groups. Microsoft does **not** support nested group membership for this assignment - a user must be a **direct** member of the assigned group to receive the profile (and therefore the Global Secure Access client routing). A nested assignment group silently leaves part of the intended population without the profile.

#### Remediation action:

1. Identify the flagged traffic forwarding profile assignment group(s).
2. Either flatten the group to direct user membership, or assign the nested group(s) to the profile directly.
3. Re-test to confirm that no profile assignment group contains a nested group.

#### Related links

* [Assign users and groups to traffic forwarding profiles](https://learn.microsoft.com/entra/global-secure-access/how-to-manage-users-groups-assignment)
* [Global Secure Access traffic forwarding profiles](https://learn.microsoft.com/entra/global-secure-access/concept-traffic-forwarding)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1189 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Global Secure Access |
| Area | Access control |
| Resource type | Group |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtGsaForwardingProfileAssignmentNotNested](https://github.com/maester365/maester/blob/main/tests/maester/global-secure-access/Test.MT.1189.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
| Lifecycle | Preview |

</details>

## Source

- Test: [`tests/maester/global-secure-access/Test.MT.1189.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/global-secure-access/Test.MT.1189.ps1)
- Documentation: [`tests/maester/global-secure-access/Test.MT.1189.md`](https://github.com/maester365/maester/blob/main/tests/maester/global-secure-access/Test.MT.1189.md)