# Private network connectors are active and healthy to maintain Zero Trust access to internal resources
When Microsoft Entra private network connectors are inactive or unhealthy, organizations might resort to using less secure access methods.
Source: https://maester.dev/docs/tests/ZTA.25391
## Overview
When Microsoft Entra private network connectors are inactive or unhealthy, organizations might resort to using less secure access methods. This condition creates opportunities where threat actors can target externally exposed services or use compromised credentials.
Without functional connectors:
- Token-based authentication and authorization for all Microsoft Entra Private Access scenarios is eliminated.
- Threat actors can bypass intended security boundaries to access resources beyond their authorization scope.
- The service can't route requests properly, directly disrupting network access controls.
## Remediation
- [Configure connectors for high availability](https://learn.microsoft.com/entra/global-secure-access/how-to-configure-connectors?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
- Monitor connector health in the Microsoft Entra admin center under Global Secure Access > Connect > Connectors.
- [Troubleshoot connector installation and connectivity issues](https://learn.microsoft.com/entra/global-secure-access/troubleshoot-connectors?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Low |
| Impact on users | Medium |
| Pillar | Network |
| Category | Global Secure Access |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Global Secure Access |
| Area | Infrastructure hardening |
| Licence | Entra_Premium_Private_Access |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.