Internet traffic is protected against threats using Global Secure Access threat intelligence filtering

Overview

Without threat intelligence filtering enabled in Global Secure Access, internet traffic from users and devices remains unprotected against connections to malicious destinations. Threat actors can leverage this gap to establish initial access through phishing sites that harvest credentials or deliver malware payloads. Once malware executes on a compromised endpoint, it can communicate with command-and-control (C2) infrastructure to receive instructions, download additional tools, or exfiltrate sensitive data. Microsoft defines high severity threats as domains or URLs associated with active malware distribution, phishing campaigns, C2 infrastructure, and other indicators identified by Microsoft and third-party threat intelligence feeds with high confidence. The threat intelligence policy in Global Secure Access blocks traffic based on domain and URL indicators from these feeds in real-time. When this protection is not enabled, threat actors maintain unrestricted network communication paths, enabling persistence mechanisms to survive detection and lateral movement to additional systems. The baseline security profile provides tenant-wide protection without requiring Conditional Access policy configuration, while custom security profiles enable context-aware enforcement through Conditional Access integration.

Remediation

• Configure threat intelligence filtering in Global Secure Access to block connections to destinations on the threat intelligence feed
• Understand security profiles, how filtering policies are grouped into them, and how policy priority is processed
• Link a security profile to a Conditional Access policy using the Global Secure Access session control
• Link a security policy to the baseline profile for tenant-wide protection without Conditional Access

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Medium
Pillar	Network
Category	Global Secure Access
Product	Entra ID
Feature	Global Secure Access
Area	Access control
ATT&CK	T1204.001 Malicious Link, T1566.002 Spearphishing Link, T1071.001 Web Protocols
Licence	Entra_Premium_Internet_Access
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.