Quick Access is bound to a Conditional Access policy

Overview

When you configure Quick Access in Microsoft Entra Private Access without Conditional Access policies, threat actors who compromise user credentials gain unrestricted access to private resources. The Quick Access application serves as a container for private resources including FQDNs and IP addresses.

Without policy enforcement:

• Compromised accounts provide a direct pathway to internal systems.
• Threat actors operating from unmanaged devices or anomalous locations can access private resources indistinguishably from authorized users.
• Lateral movement across the internal network and data exfiltration from private applications become possible.
• Multifactor authentication requirements and device health checks can’t be enforced.

Remediation

• Apply Conditional Access Policies to Microsoft Entra Private Access Apps.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Medium
Pillar	Network
Category	Global Secure Access
Product	Entra ID
Feature	Global Secure Access
Area	Access control
ATT&CK	T1078.004 Cloud Accounts, T1133 External Remote Services
Licence	Entra_Premium_Private_Access, AAD_PREMIUM
Tenant	Workforce, External

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.