# Source IP restoration is enabled
When organizations deploy Global Secure Access as their cloud-based network proxy, Microsoft's Secure Service Edge infrastructure routes user traffic.
Source: https://maester.dev/docs/tests/ZTA.25370
## Overview
When organizations deploy Global Secure Access as their cloud-based network proxy, Microsoft's Secure Service Edge infrastructure routes user traffic. If you don't enable source IP restoration, all authentication requests come from the proxy's IP address instead of the user's actual public egress IP.
Without this protection:
- Threat actors who compromise user credentials can authenticate from any location while bypassing IP-based Conditional Access controls and named location policies.
- Microsoft Entra ID Protection risk detections lose visibility into the original user IP address, which degrades the accuracy of risk scoring algorithms.
- Sign-in logs and audit trails no longer show the true source of authentication attempts, which makes incident investigation and forensic analysis more difficult.
## Remediation
- Enable Global Secure Access signaling in Conditional Access. For more information, see [Source IP restoration](https://learn.microsoft.com/entra/global-secure-access/how-to-source-ip-restoration?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Network |
| Category | Network |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Global Secure Access |
| Area | Access control |
| ATT&CK | [T1078.004](/docs/tests?mitre=T1078.004) Cloud Accounts |
| Licence | Entra_Premium_Private_Access, Entra_Premium_Internet_Access |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.