# Groups assigned to Entra Private Access applications should not be nested

Microsoft Entra enterprise application assignment grants access to the direct (and dynamic) members of an assigned group only - the assignment does not…

Source: https://maester.dev/docs/tests/MT.1192

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/crmhh" title="Christopher Brumm · Original author"><img src="https://github.com/crmhh.png" alt="Christopher Brumm" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/crmhh">Christopher Brumm</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Entra ID · Global Secure Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1192 -IncludePreview
```

## Overview

Microsoft Entra enterprise application assignment grants access to the **direct** (and dynamic) members of an assigned group only - the assignment does **not** cascade to nested groups, and nested group membership is not supported for app assignment. Groups assigned to Global Secure Access Private Access applications (and the Quick Access app) must therefore use direct membership, otherwise members of a nested group are silently left without access.

This limitation applies only to app assignment. Conditional Access scoping does honor nested groups, so the MFA and managed-device coverage checks are not affected.

#### Remediation action:

1. Identify the flagged Private Access / Quick Access application assignment group(s).
2. Either flatten the group to direct (or dynamic) membership, or assign the nested group(s) to the application directly.
3. Re-test to confirm that no assignment group contains a nested group.

#### Related links

* [Assign users and groups to an application](https://learn.microsoft.com/entra/identity/enterprise-apps/assign-user-or-group-access-portal)
* [Use a group to manage access to applications](https://learn.microsoft.com/entra/identity/users/groups-saasapps)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1192 |
| Severity | Low |
| Suite | Maester |
| Product | Entra ID |
| Feature | Global Secure Access |
| Area | Access control |
| Resource type | Group |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtGsaPrivateAccessAppAssignmentNotNested](https://github.com/maester365/maester/blob/main/tests/maester/global-secure-access/Test.MT.1192.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
| Lifecycle | Preview |

</details>

## Source

- Test: [`tests/maester/global-secure-access/Test.MT.1192.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/global-secure-access/Test.MT.1192.ps1)
- Documentation: [`tests/maester/global-secure-access/Test.MT.1192.md`](https://github.com/maester365/maester/blob/main/tests/maester/global-secure-access/Test.MT.1192.md)