# Azure resources used by Microsoft Entra only allow access from privileged roles
Azure resources used by Microsoft Entra only allow access from privileged roles: a Microsoft Zero Trust Assessment check, with its severity, effort and the…
Source: https://maester.dev/docs/tests/ZTA.21912
## Overview
Microsoft has not published a description of this check yet.
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Identity |
| Category | Access control |
| Product | [Azure](/docs/tests/products/azure) |
| Feature | Access management |
| Area | Privileged access |
| ATT&CK | [T1078.004](/docs/tests?mitre=T1078.004) Cloud Accounts, [T1685.002](/docs/tests?mitre=T1685.002) Disable or Modify Cloud Log |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.