# All groups in Conditional Access policies belong to a restricted management administrative unit
All groups in Conditional Access policies belong to a restricted management administrative unit: a Microsoft Zero Trust Assessment check, with its…
Source: https://maester.dev/docs/tests/ZTA.21832
:::note[Maester checks this too]
[MT.1035](/docs/tests/MT.1035) (All security groups assigned to Conditional Access Policies should be protected by RMAU.) checks the same setting. Running both reports it twice.
:::
## Overview
Microsoft has not published a description of this check yet.
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Identity |
| Category | Access control |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Conditional Access |
| Area | Privileged access |
| ATT&CK | [T1098](/docs/tests?mitre=T1098) Account Manipulation, [T1556.009](/docs/tests?mitre=T1556.009) Conditional Access Policies |
| Licence | P1 |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.