# Network access activity is visible to security operations for threat detection and response
Without Global Secure Access logs integrated into a Microsoft Sentinel workspace, security operations teams lack centralized visibility into network…
Source: https://maester.dev/docs/tests/ZTA.25419
## Overview
Without Global Secure Access logs integrated into a Microsoft Sentinel workspace, security operations teams lack centralized visibility into network traffic patterns, connection attempts, and access anomalies across Private Access, Internet Access, and Microsoft 365 traffic forwarding. Threat actors who compromise user credentials or devices can use these network access paths to perform reconnaissance, move laterally, or exfiltrate data without detection.
Without this integration:
- Security teams can't correlate network-layer activities with identity-based signals in Microsoft Entra ID or endpoint detections.
- Security information and event management (SIEM) systems can't apply behavioral analytics, threat intelligence correlation, or automated response playbooks to Global Secure Access traffic.
- Security teams can't investigate historical network access patterns or hunt for threats across network and identity signals.
## Remediation
- [Configure Microsoft Entra diagnostic settings](https://learn.microsoft.com/entra/global-secure-access/how-to-sentinel-integration?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) to send Global Secure Access logs to a Log Analytics workspace for Microsoft Sentinel integration.
- [Enable all required Global Secure Access identity log categories](https://learn.microsoft.com/entra/identity/monitoring-health/concept-diagnostic-settings-logs-options?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci), including `NetworkAccessTrafficLogs`, `EnrichedOffice365AuditLogs`, `RemoteNetworkHealthLogs`, `NetworkAccessAlerts`, `NetworkAccessConnectionEvents`, and `NetworkAccessGenerativeAIInsights` in diagnostic settings.
- [Integrate Microsoft Entra activity logs with Azure Monitor](https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) for centralized log collection.
- [Configure a Microsoft Sentinel workspace](https://learn.microsoft.com/azure/sentinel/quickstart-onboard?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) and install the Global Secure Access solution from the content hub.
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Network |
| Category | Global Secure Access |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Logs and monitoring |
| Area | Logging and detection |
| ATT&CK | [T1046](/docs/tests?mitre=T1046) Network Service Discovery, [T1021](/docs/tests?mitre=T1021) Remote Services, [T1041](/docs/tests?mitre=T1041) Exfiltration Over C2 Channel |
| Licence | Entra_Premium_Private_Access, Entra_Premium_Internet_Access, AAD_PREMIUM |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.