Global Secure Access deployment logs are populated and reviewed

Overview

Global Secure Access deployment logs track the status and progress of configuration changes across the global network. These changes include forwarding profile redistributions, remote network updates, filtering profile changes, and changes to Conditional Access settings. If deployment logs show failed deployments, threat actors can exploit inconsistent security configurations where some edge locations have outdated or misconfigured policies.

If you don’t monitor deployment logs:

• Failed deployments can leave security gaps such as outdated forwarding profiles that don’t route traffic through security inspection, or filtering profiles that don’t block malicious destinations.
• Administrators might remain unaware of outdated configurations, believing that changes are applied uniformly.
• Deployment failures that create exploitable gaps can go undetected.

Remediation

• Follow the steps in How to use the Global Secure Access deployment logs to:
  • Access and review deployment logs in the Microsoft Entra admin center to identify failed deployments.
  • For failed deployments, examine the error message in the status.message field and retry the configuration change that triggered the failure.
  • Monitor deployment notifications that appear in the admin center when making configuration changes to catch failures in real-time.
• If deployments consistently fail for remote networks, review the underlying remote network configuration for errors.
• For forwarding profile deployment failures, verify traffic forwarding configuration.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Low
Impact on users	Low
Pillar	Network
Category	Global Secure Access
Product	Entra ID
Feature	Global Secure Access
Area	Logging and detection
Licence	Entra_Premium_Internet_Access, Entra_Premium_Private_Access
Tenant	Workforce, External

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.