The tenant holds the licenses required to operate Global Secure Access

Overview

Global Secure Access requires specific Microsoft Entra licenses to function, including Microsoft Entra Internet Access and Microsoft Entra Private Access, both of which require Microsoft Entra ID P1 as a prerequisite. Without valid licenses provisioned in the tenant, administrators can’t configure traffic forwarding profiles, security policies, or remote network connections. If you don’t assign licenses to users, their traffic doesn’t route through Global Secure Access, and remains unprotected by security controls.

Without this protection:

• Threat actors can bypass web content filtering, threat protection, and Conditional Access policies.
• Expired or suspended subscriptions can halt the Global Secure Access service, creating security gaps where previously protected traffic flows go unmonitored.

Remediation

• Review Global Secure Access licensing requirements and purchase appropriate licenses. For more information, see Licensing overview.
• Assign licenses to users through the Microsoft 365 admin center. For more information, see Assign or unassign licenses for users in the Microsoft 365 admin center.
• Use group-based licensing for easier management at scale. For more information, see Assign or unassign licenses to a group in the Microsoft 365 admin center.
• Monitor license utilization through Microsoft 365 admin center. For more information, see Microsoft 365 admin center.
• Review Microsoft Entra Suite as an alternative that includes both Internet Access and Private Access. For more information, see What’s new in Microsoft Entra.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	Network
Category	Global Secure Access
Product	Entra ID
Feature	Global Secure Access
Area	Infrastructure hardening
Licence	AAD_PREMIUM, AAD_PREMIUM_P2
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.