Global Secure Access signaling for Conditional Access is enabled

Overview

When Global Secure Access routes user traffic through Microsoft’s Security Service Edge, it replaces the original source IP with the proxy egress IP. If you don’t enable Global Secure Access signaling for Conditional Access, Microsoft Entra ID receives the proxy IP instead of the user’s actual IP address. Conditional Access policies that rely on named locations or trusted IP ranges evaluate the proxy IP instead of the user’s actual IP, reducing the effectiveness of location-based controls.

If you don’t enable Global Secure Access signaling for Conditional Access:

• Microsoft Entra ID Protection risk detections that depend on source IP, such as impossible travel and unfamiliar sign-in properties, are less reliable.
• Sign-in logs record the proxy IP, which prevents security operations teams from correlating sign-in events to user locations during incident response.

Remediation

• Enable Global Secure Access signaling for Conditional Access.
• Enable compliant network check with Conditional Access to require users to connect through Global Secure Access.
• Understand how Universal Conditional Access works with Global Secure Access traffic profiles.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Low
Impact on users	High
Pillar	Network
Category	Global Secure Access
Product	Entra ID
Feature	Global Secure Access
Area	Access control
ATT&CK	T1078.004 Cloud Accounts
Licence	AAD_PREMIUM, Entra_Premium_Internet_Access
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.