Traffic forwarding profiles are scoped to appropriate users and groups for controlled deployment

Overview

Without proper scoping of traffic forwarding profiles, organizations risk either exposing all users to security controls before infrastructure readiness is validated or inadvertently excluding users who should be protected.

Risks of improper scoping:

• Too broad: When profiles are assigned to “all users” without deliberate planning, a misconfiguration could disrupt network connectivity for the entire organization simultaneously.
• Too narrow: If profiles are scoped too narrowly or assignments are incomplete, a subset of users operates outside the security perimeter, creating gaps that threat actors can exploit.
• Unmonitored access: Attackers who compromise devices belonging to unassigned users can access resources without traffic being inspected, logged, or subject to security policies.

Proper scoping ensures controlled rollout—starting with pilot groups to validate functionality, then expanding to broader populations—while maintaining visibility into which users are protected.

Remediation

• Assign users and groups to traffic forwarding profiles. For more information, see Manage users and groups assignment.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	Network
Category	Global Secure Access
Product	Entra ID
Feature	Global Secure Access
Area	Access control
Licence	Entra_Premium_Internet_Access, Entra_Premium_Private_Access
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.