Quick Access is enabled and bound to a connector

Overview

When you don’t configure Quick Access or bind it to a connector group with active connectors, users can access private network resources through paths that bypass Global Secure Access controls. Threat actors who compromise user credentials can reach internal FQDNs and IP ranges without Conditional Access evaluation, because traffic doesn’t route through the Global Secure Access service.

Without connector-mediated traffic brokering:

• There’s no enforcement point between the user and the private resource, so Conditional Access policies targeting the Quick Access enterprise application don’t apply.
• Threat actors can use stolen credentials to authenticate, move between internal systems, and exfiltrate data.
• The organization loses visibility through Global Secure Access traffic logs.

If you bind Quick Access to a connector group with active connectors, you ensure that private network traffic routes through Global Secure Access, where Conditional Access policies, user assignments, and traffic logging apply.

Remediation

• Configure Quick Access for Global Secure Access.
• Configure private network connectors for Global Secure Access.
• Enable the Private Access traffic forwarding profile.
• Review Microsoft Entra Private Access concepts.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Medium
Pillar	Network
Category	Global Secure Access
Product	Entra ID
Feature	Global Secure Access
Area	Access control
ATT&CK	T1078.004 Cloud Accounts, T1133 External Remote Services
Licence	AAD_PREMIUM, Entra_Premium_Private_Access
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.