Conditional Access policies use compliant network controls

Overview

Without compliant network controls in Conditional Access policies, organizations can’t enforce that users connect to corporate resources through the Global Secure Access service. This limitation leaves authentication traffic vulnerable to interception and replay attacks from arbitrary network locations.

A threat actor who obtains valid user credentials through phishing or credential theft can authenticate from any internet location, bypassing Global Secure Access network controls. Once authenticated, the threat actor can access Microsoft Entra ID-integrated applications and services, exfiltrate data, or establish persistence by creating additional credentials or modifying user permissions.

The compliant network check reduces this risk by requiring that authentication traffic originates from the Global Secure Access service, which tags authentication requests with tenant-specific network identity signals. This requirement enables Microsoft Entra ID Conditional Access to verify that users connect through the organization’s secured network path before granting access.

Remediation

• Enable Global Secure Access signaling for Conditional Access. For more information, see Enable compliant network check with Conditional Access.
• Create a Conditional Access policy that requires compliant network for access. For more information, see Protect your resources behind the compliant network.
• Deploy Global Secure Access clients on devices. For more information, see Global Secure Access clients overview.
• Understand compliant network enforcement. For more information, see Compliant network check enforcement.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Medium
Impact on users	Medium
Pillar	Network
Category	Global Secure Access
Product	Entra ID
Feature	Global Secure Access
Area	Access control
ATT&CK	T1078.004 Cloud Accounts, T1550.001 Application Access Token
Licence	AAD_PREMIUM, AAD_PREMIUM_P2
Tenant	Workforce, External

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.