Global Secure Access cloud firewall protects branch office internet traffic

Overview

When you connect remote networks to Global Secure Access through IPsec tunnels but don’t set up cloud firewall policies, all internet-bound traffic from branch offices goes through the Security Service Edge without egress filtering controls. If a threat actor gains access to a branch office workstation, they can make outbound connections to command-and-control infrastructure, exfiltrate data over standard ports, or download malicious payloads without network-layer inspection.

Without Global Secure Access cloud firewall:

• You can’t enforce a deny-by-default posture or restrict outbound communications from branch networks to unauthorized internet destinations.
• Threat actors can stage data for exfiltration, pivot to cloud resources, or move laterally without detection.
• Traditional perimeter defenses might assume all egress is legitimate, resulting in gaps in security coverage.

Cloud firewall policies linked to the baseline profile provide centralized egress control for all remote network traffic. Administrators can use these policies to define granular filtering rules that restrict unauthorized outbound communications.

Remediation

• As a prerequisite for cloud firewall, configure remote networks for internet access.
• Follow the steps in Configure Global Secure Access cloud firewall to:
  • Create a cloud firewall policy with appropriate filtering rules.
  • Add or update firewall rules based on source IP, destination IP, ports, and protocols.
  • Link the cloud firewall policy to the baseline profile for remote networks.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Low
Pillar	Network
Category	Global Secure Access
Product	Entra ID
Feature	Global Secure Access
Area	Access control
ATT&CK	T1071 Application Layer Protocol, T1041 Exfiltration Over C2 Channel, T1105 Ingress Tool Transfer
Licence	Entra_Premium_Internet_Access
Tenant	Workforce, External

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.