Entra Private Access Application segments are defined to enforce least-privilege access

Overview

When organizations configure Microsoft Entra Private Access with broad application segments, such as wide IP ranges, multiple protocols, or Quick Access configurations, they effectively replicate the over-permissive access model of traditional VPNs. This approach contradicts the Zero Trust principle of least privilege, where users should only reach the specific resources required for their role.

Risks of broad segmentation:

• Threat actors who compromise a user’s credentials or device can use broad network permissions to perform reconnaissance, identifying other systems and services within the permitted range.
• Lateral movement becomes easier as attackers can access multiple systems through a single compromised credential.
• Incident response is complicated because security teams can’t quickly determine which specific resources a compromised identity could access.

Configuring per-application segmentation with tightly scoped destination hosts, specific ports, and Custom Security Attributes enables dynamic Conditional Access enforcement. This approach requires stronger authentication or device compliance for high-risk applications while streamlining access to lower-risk resources.

Remediation

• Review and refine application segments to use specific FQDNs, IP addresses, and specific port ranges that match application requirements rather than wide port ranges.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	High
Impact on users	Medium
Pillar	Network
Category	Global Secure Access
Product	Entra ID
Feature	Global Secure Access
Area	Access control
ATT&CK	T1046 Network Service Discovery, T1021 Remote Services
Licence	Entra_Premium_Private_Access
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.