File transfer policies are configured to prevent data exfiltration

Overview

Without network content filtering policies configured in Global Secure Access, threat actors can exfiltrate data to unsanctioned destinations through browsers, applications, and APIs. File sharing services, cloud storage providers, and peer-to-peer transfer sites remain unrestricted when you don’t implement network content filtering policies.

Without this protection:

• Threat actors can upload files containing intellectual property, credentials, or customer data to external services without detection.
• Unmanaged cloud applications and generative AI tools become exfiltration channels for sensitive information.
• The network layer lacks real-time data protection enforcement, allowing threat actors to bypass endpoint-based controls.
• Threat actors can disguise malicious payloads or sensitive data within common file formats and transfer them across the network perimeter undetected.

Remediation

• Configure Global Secure Access web content filtering, including file policies to monitor and control file transfers.
• Enable and manage the Microsoft traffic forwarding profile that group filtering policies for enforcement through Conditional Access.
• Link security profiles to Conditional Access policies for user-aware and context-aware enforcement of network security policies.
• Install the Global Secure Access client on end-user devices to enable traffic acquisition and policy enforcement.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	High
Impact on users	Medium
Pillar	Network
Category	Global Secure Access
Product	Entra ID
Feature	Global Secure Access
Area	Data protection
ATT&CK	T1567 Exfiltration Over Web Service
Licence	Entra_Premium_Internet_Access
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.