# Internet traffic is protected against threats using Global Secure Access threat intelligence filtering
Without threat intelligence filtering enabled in Global Secure Access, internet traffic from users and devices remains unprotected against connections to…
Source: https://maester.dev/docs/tests/ZTA.25412
## Overview
Without threat intelligence filtering enabled in Global Secure Access, internet traffic from users and devices remains unprotected against connections to malicious destinations. Threat actors can leverage this gap to establish initial access through phishing sites that harvest credentials or deliver malware payloads. Once malware executes on a compromised endpoint, it can communicate with command-and-control (C2) infrastructure to receive instructions, download additional tools, or exfiltrate sensitive data. Microsoft defines high severity threats as domains or URLs associated with active malware distribution, phishing campaigns, C2 infrastructure, and other indicators identified by Microsoft and third-party threat intelligence feeds with high confidence. The threat intelligence policy in Global Secure Access blocks traffic based on domain and URL indicators from these feeds in real-time. When this protection is not enabled, threat actors maintain unrestricted network communication paths, enabling persistence mechanisms to survive detection and lateral movement to additional systems. The baseline security profile provides tenant-wide protection without requiring Conditional Access policy configuration, while custom security profiles enable context-aware enforcement through Conditional Access integration.
## Remediation
- [Configure threat intelligence filtering in Global Secure Access to block connections to destinations on the threat intelligence feed](https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-threat-intelligence)
- [Understand security profiles, how filtering policies are grouped into them, and how policy priority is processed](https://learn.microsoft.com/en-us/entra/global-secure-access/concept-internet-access#security-profiles)
- [Link a security profile to a Conditional Access policy using the Global Secure Access session control](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-session#use-global-secure-access-security-profile)
- [Link a security policy to the baseline profile for tenant-wide protection without Conditional Access](https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-apply-security-policies-remote-network)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Medium |
| Pillar | Network |
| Category | Global Secure Access |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Global Secure Access |
| Area | Access control |
| ATT&CK | [T1204.001](/docs/tests?mitre=T1204.001) Malicious Link, [T1566.002](/docs/tests?mitre=T1566.002) Spearphishing Link, [T1071.001](/docs/tests?mitre=T1071.001) Web Protocols |
| Licence | Entra_Premium_Internet_Access |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.