# Quick Access is bound to a Conditional Access policy
When you configure Quick Access in Microsoft Entra Private Access without Conditional Access policies, threat actors who compromise user credentials gain…
Source: https://maester.dev/docs/tests/ZTA.25394
## Overview
When you configure Quick Access in Microsoft Entra Private Access without Conditional Access policies, threat actors who compromise user credentials gain unrestricted access to private resources. The Quick Access application serves as a container for private resources including FQDNs and IP addresses.
Without policy enforcement:
- Compromised accounts provide a direct pathway to internal systems.
- Threat actors operating from unmanaged devices or anomalous locations can access private resources indistinguishably from authorized users.
- Lateral movement across the internal network and data exfiltration from private applications become possible.
- Multifactor authentication requirements and device health checks can't be enforced.
## Remediation
- [Apply Conditional Access Policies to Microsoft Entra Private Access Apps](https://learn.microsoft.com/entra/global-secure-access/how-to-target-resource-private-access-apps?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Medium |
| Pillar | Network |
| Category | Global Secure Access |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Global Secure Access |
| Area | Access control |
| ATT&CK | [T1078.004](/docs/tests?mitre=T1078.004) Cloud Accounts, [T1133](/docs/tests?mitre=T1133) External Remote Services |
| Licence | Entra_Premium_Private_Access, AAD_PREMIUM |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.